[Shared Samples] [PR #4513] modified rule: PR# 4513 - VIP impersonation with invoicing request

Author: github-actions[bot]

detection-rules/4513_impersonation_vip_invoicing_request.yml

@@ -5,12 +5,23 @@ severity: "high"
 source: |
   type.inbound
   and any($org_vips,
-          strings.contains(sender.display_name, .display_name)
-          or strings.contains(sender.display_name,
-                              strings.concat(.first_name, " ", .last_name)
+          (
+            .display_name != ""
+            and strings.contains(sender.display_name, .display_name)
           )
-          or strings.contains(sender.display_name,
-                              strings.concat(.last_name, ", ", .first_name)
+          or (
+            .first_name != ""
+            and .last_name != ""
+            and strings.contains(sender.display_name,
+                                 strings.concat(.first_name, " ", .last_name)
+            )
+          )
+          or (
+            .first_name != ""
+            and .last_name != ""
+            and strings.contains(sender.display_name,
+                                 strings.concat(.last_name, ", ", .first_name)
+            )
           )
   )
   and (