[Test Rules] [PR #4515] modified rule: Fake thread with suspicious indicators

Author: github-actions[bot]

detection-rules/4515_fake_thread_suspicious_indicators.yml

@@ -121,21 +121,25 @@ source: |
     (
       any($org_vips,
           strings.icontains(body.html.inner_text, .display_name)
-          or strings.icontains(body.html.inner_text,
-                               strings.concat(.first_name, " ", .last_name)
-          )
           or strings.icontains(body.html.inner_text,
                                strings.concat(.last_name, ", ", .first_name)
           )
+          or any(regex.extract(.display_name,
+                               '\A(?P<name>.+?)\s*[\(（][^)）]*[)）]\s*\z'
+                 ),
+                 strings.icontains(body.html.inner_text, .named_groups["name"])
+          )
       )
       or any($org_vips,
              strings.icontains(body.plain.raw, .display_name)
-             or strings.icontains(body.plain.raw,
-                                  strings.concat(.first_name, " ", .last_name)
-             )
              or strings.icontains(body.plain.raw,
                                   strings.concat(.last_name, ", ", .first_name)
              )
+             or any(regex.extract(.display_name,
+                                  '\A(?P<name>.+?)\s*[\(（][^)）]*[)）]\s*\z'
+                    ),
+                    strings.icontains(body.plain.raw, .named_groups["name"])
+             )
       )
     ),
   
@@ -204,4 +208,4 @@ detection_methods:
 id: "5bdf57da-06d5-51ea-bcf6-4a6be0d461bb"
 og_id: "c2e18a57-1f52-544f-bb6d-a578e286cf89"
 testing_pr: 4515
-testing_sha: 1658ad9fc984cdf4e2a8a85f6af83206ffd6dde1
+testing_sha: 3c7644f9963fb214445fd5add76ce8f949a4acf0