[Test Rules] [PR #4633] modified rule: Brand impersonation: UPS

Author: github-actions[bot]

detection-rules/4633_impersonation_ups.yml

@@ -1,4 +1,4 @@
-name: "Brand Impersonation: UPS Delivery"
+name: "Brand impersonation: UPS"
 description: |
   Detects messages impersonating UPS (United Parcel Service) through display name, email address patterns, subject content, or HTML styling that mimics UPS branding, while excluding legitimate UPS domains.
 references:
@@ -11,8 +11,8 @@ source: |
   type.inbound
   and sender.email.domain.root_domain not in ("ups.com", "upsemail.com")
   and (
-    sender.display_name in~ ("UPS My Choice", "UPS Services")
-    or regex.icontains(sender.display_name, 'UPS-\w+')
+    sender.display_name in~ ("UPS My Choice", "UPS Services", "Ups.com")
+    or regex.icontains(sender.display_name, 'ups-\w+')
     or strings.ilike(sender.email.local_part, "*united*parcel*service*")
     or strings.ilike(sender.email.domain.domain, '*united*parcel*service*')
     or strings.icontains(subject.subject, 'UPS delivery')
@@ -55,4 +55,4 @@ detection_methods:
 id: "65eee471-2ab1-5264-9ce8-a404684b1cc8"
 og_id: "73b68869-5720-5dc3-b4bc-15730de972d8"
 testing_pr: 4633
-testing_sha: 9a541eec318bd3eb797c0c8d30c40ae8f740f8eb
+testing_sha: b1cd8fc04df9d6cd1983c580e00acbe7e55471e7