[Test Rules] [PR #4515] modified rule: Service abuse: Trello board invitation with VIP impersonation

Author: github-actions[bot]

detection-rules/4515_service_abuse_trello_board_invite_vip.yml

@@ -29,12 +29,14 @@ source: |
         // org vip
         any($org_vips,
             strings.icontains(..display_text, .display_name)
-            or strings.icontains(..display_text,
-                                 strings.concat(.first_name, " ", .last_name)
-            )
             or strings.icontains(..display_text,
                                  strings.concat(.last_name, ", ", .first_name)
             )
+            or any(regex.extract(.display_name,
+                                 '\A(?P<name>.+?)\s*[\(（][^)）]*[)）]\s*\z'
+                   ),
+                   strings.icontains(...display_text, .named_groups["name"])
+            )
         )
         // org sld as the board name
         and any($org_slds,
@@ -51,18 +53,19 @@ source: |
            and strings.iends_with(.display_text, 'From')
            and any($org_vips,
                    strings.icontains(..display_text, .display_name)
-                   or strings.icontains(..display_text,
-                                        strings.concat(.first_name,
-                                                       " ",
-                                                       .last_name
-                                        )
-                   )
                    or strings.icontains(..display_text,
                                         strings.concat(.last_name,
                                                        ", ",
                                                        .first_name
                                         )
                    )
+                   or any(regex.extract(.display_name,
+                                        '\A(?P<name>.+?)\s*[\(（][^)）]*[)）]\s*\z'
+                          ),
+                          strings.icontains(...display_text,
+                                            .named_groups["name"]
+                          )
+                   )
            )
     )
   )
@@ -79,4 +82,4 @@ detection_methods:
 id: "e42bdd9e-3872-5266-bf29-791ebfa714a7"
 og_id: "fedfc94b-4a33-57e0-a891-1af92aec6ddb"
 testing_pr: 4515
-testing_sha: 1658ad9fc984cdf4e2a8a85f6af83206ffd6dde1
+testing_sha: 3c7644f9963fb214445fd5add76ce8f949a4acf0