[Test Rules] [PR #4498] modified rule: Link: Generic financial document and suspicious hosting template

Author: github-actions[bot]

detection-rules/4498_link_financial_document_timeline_template.yml

@@ -4,26 +4,20 @@ type: "rule"
 severity: "medium"
 source: |
   type.inbound
-  // nlu filtering
-  and not (
-    any(ml.nlu_classifier(body.current_thread.text).intents, .name == "benign")
-    and not length(body.current_thread.text) <= 1600
-  )
-  
   // expectation of time
   and regex.icontains(body.current_thread.text,
-                      'will be released|\b[1-4].[1-4]\b.{1,10}days?'
+                      'will be released.{0,15}(?:(Monday|Tuesday|Wednesday|Thursday|Friday|Saturday|Sunday),\s+(January|February|March|April|May|June|July|August|September|October|November|December)\s+\d{1,2},)|\b[1-4]\W[1-4]\b.{1,10}days'
   )
   
   // link is malicious
   and any(body.links,
           // key phrasing or nlu
           (
             regex.icontains(.display_text,
-                            '(?:access|view).{0,10}|payment|statement'
+                            '(?:access|show|view).{0,10}(?:confirmation|message|payment|statement)|advice|deposit|document|eft|release|remit'
             )
             or any(ml.nlu_classifier(body.current_thread.text).topics,
-                   .name == "Request to View Invoice" and .confidence != "low"
+                   .name == "Request to View Invoice" and .confidence == "high"
             )
           )
           // suspicious hosting
@@ -32,7 +26,7 @@ source: |
             or .href_url.domain.tld in $suspicious_tlds
             or .href_url.domain.root_domain not in $tranco_1m
             // open redirect
-            or strings.icontains(.href_url.query_params, '=https')
+            or strings.icontains(.href_url.query_params, '=https', 'url=')
           )
           // negate org domains
           and .href_url.domain.valid != false
@@ -70,4 +64,4 @@ detection_methods:
 id: "1a6e4ced-4391-597f-9184-d4d1c57dedc7"
 og_id: "027cb65d-aee3-5f10-9555-20b719bbde42"
 testing_pr: 4498
-testing_sha: e6a854f326d20dc2452a4350622bd79e632a7d88
+testing_sha: b8a832d865599082a987be2bc64bcb4e71e777dd