[Shared Samples] [PR #4515] modified rule: PR# 4515 - VIP impersonation with charitable donation fraud

Author: github-actions[bot]

detection-rules/4515_vip_impersonation_charity.yml

@@ -18,21 +18,43 @@ source: |
   )
   and (
     any($org_vips,
-        strings.icontains(body.html.inner_text, .display_name)
-        or strings.icontains(body.html.inner_text,
-                             strings.concat(.first_name, " ", .last_name)
+        (
+          .display_name != ""
+          and strings.icontains(body.html.inner_text, .display_name)
         )
-        or strings.icontains(body.html.inner_text,
-                             strings.concat(.last_name, ", ", .first_name)
+        or (
+          .first_name != ""
+          and .last_name != ""
+          and strings.icontains(body.html.inner_text,
+                                strings.concat(.first_name, " ", .last_name)
+          )
+        )
+        or (
+          .first_name != ""
+          and .last_name != ""
+          and strings.icontains(body.html.inner_text,
+                                strings.concat(.last_name, ", ", .first_name)
+          )
         )
     )
     or any($org_vips,
-           strings.icontains(body.plain.raw, .display_name)
-           or strings.icontains(body.plain.raw,
-                                strings.concat(.first_name, " ", .last_name)
+           (
+             .display_name != ""
+             and strings.icontains(body.plain.raw, .display_name)
            )
-           or strings.icontains(body.plain.raw,
-                                strings.concat(.last_name, ", ", .first_name)
+           or (
+             .first_name != ""
+             and .last_name != ""
+             and strings.icontains(body.plain.raw,
+                                   strings.concat(.first_name, " ", .last_name)
+             )
+           )
+           or (
+             .first_name != ""
+             and .last_name != ""
+             and strings.icontains(body.plain.raw,
+                                   strings.concat(.last_name, ", ", .first_name)
+             )
            )
     )
   )