Add first_name/last_name concat matching to org_vips sender rules by IndiaAce · Pull Request #4513 · sublime-security/sublime-rules

IndiaAce · 2026-05-20T16:49:45Z

Description

Add alternative name matching logic to org_vips sender-based rules to handle cases where
display_name is stored as "Lastname, Firstname" instead of "Firstname Lastname".
Uses strings.concat(.first_name, " ", .last_name) and strings.concat(.last_name, ", ", .first_name)
as additional or conditions inside existing any($org_vips, ...) blocks.

This is a test rule deployment to assess impact magnitude.

Affected rules

impersonation_vip_bec_loose.yml
vip_impersonation.yml
impersonation_vip_urgent_request.yml
impersonation_vip_invoicing_request.yml
impersonation_vip_w2_request.yml
sender_contains_org_vip.yml (insight)

Associated samples

N/A - validation only (no TP canonical available)

Associated hunts

TBD - will be run after test rule deployment

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

…ge (near match, untrusted sender)

…request

…uest (strict match, untrusted sender)

… with reply-to mismatch

…rict match, untrusted)

… with BEC language (near match, untrusted sender)

… with invoicing request

… with urgent request (strict match, untrusted sender)

… with w2 request with reply-to mismatch

…mpersonation (strict match, untrusted)

…with BEC language (near match, untrusted sender)

…with invoicing request

…with urgent request (strict match, untrusted sender)

…with w2 request with reply-to mismatch

…personation (strict match, untrusted)

rw-access · 2026-05-20T17:46:39Z

          and not sender.email.domain.root_domain in $high_trust_sender_root_domains
          and not sender.email.domain.root_domain in $org_domains
          and headers.auth_summary.dmarc.pass


Why are these inside the any($org_vips) check?

…al stripping, revert insights - Remove redundant strings.concat(.first_name, " ", .last_name) checks (already covered by .display_name) - Keep strings.concat(.last_name, ", ", .first_name) for orgs storing VIPs as "Doe, John" - Add regex-based parenthetical stripping for VIP names like "Shelly Chaka (She/her/hers)" - Fix == to =~ for concat checks in vip_impersonation and urgent_request rules - Revert insights/sender/sender_contains_org_vip.yml to main state (out of scope) Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

…guage (near match, untrusted sender)

…ng request

…request (strict match, untrusted sender)

…est with reply-to mismatch

…(strict match, untrusted)

…ion with BEC language (near match, untrusted sender)

…ion with invoicing request

… impersonation (strict match, untrusted)

The concat(.first_name, " ", .last_name) check already handles parenthetical display names because .first_name/.last_name are stored as clean values. Also fixes == to =~ for concat checks in vip_impersonation and urgent_request. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

…ion with BEC language (near match, untrusted sender)

…ion with invoicing request

…ion with urgent request (strict match, untrusted sender)

…ion with w2 request with reply-to mismatch

…e impersonation (strict match, untrusted)

…on with BEC language (near match, untrusted sender)

…on with invoicing request

…on with urgent request (strict match, untrusted sender)

…on with w2 request with reply-to mismatch

… impersonation (strict match, untrusted)

…guage (near match, untrusted sender)

…ng request

…request (strict match, untrusted sender)

…est with reply-to mismatch

…(strict match, untrusted)

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

…on with BEC language (near match, untrusted sender)

…on with invoicing request

…on with urgent request (strict match, untrusted sender)

…on with w2 request with reply-to mismatch

… impersonation (strict match, untrusted)

…guage (near match, untrusted sender)

…ng request

…request (strict match, untrusted sender)

…est with reply-to mismatch

…(strict match, untrusted)

Add first_name/last_name concat matching to org_vips sender rules

07ab11d

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

IndiaAce requested a review from a team May 20, 2026 16:49

IndiaAce requested a review from a team as a code owner May 20, 2026 16:49

Auto-format MQL and add rule IDs

90a3176

github-actions Bot added the in-test-rules PR is in our testing suite to collect telemetry label May 20, 2026

github-actions Bot added a commit that referenced this pull request May 20, 2026

[Test Rules] [PR #4513] added rule: VIP impersonation with BEC langua…

8b3f150

…ge (near match, untrusted sender)

github-actions Bot added a commit that referenced this pull request May 20, 2026

[Test Rules] [PR #4513] added rule: VIP impersonation with invoicing …

00968ee

…request

github-actions Bot added a commit that referenced this pull request May 20, 2026

[Test Rules] [PR #4513] added rule: VIP impersonation with urgent req…

3c8af1f

…uest (strict match, untrusted sender)

github-actions Bot added a commit that referenced this pull request May 20, 2026

[Test Rules] [PR #4513] added rule: VIP impersonation with w2 request…

d49e795

… with reply-to mismatch

github-actions Bot added a commit that referenced this pull request May 20, 2026

[Test Rules] [PR #4513] added rule: VIP / Executive impersonation (st…

b9e0e6b

…rict match, untrusted)

github-actions Bot added a commit to IndiaAce/sublime-rules that referenced this pull request May 20, 2026

[Test Rules] [PR sublime-security#4513] added rule: VIP impersonation…

cfe83b9

… with BEC language (near match, untrusted sender)

github-actions Bot added a commit to IndiaAce/sublime-rules that referenced this pull request May 20, 2026

[Test Rules] [PR sublime-security#4513] added rule: VIP impersonation…

a1f08b9

… with invoicing request

github-actions Bot added a commit to IndiaAce/sublime-rules that referenced this pull request May 20, 2026

[Test Rules] [PR sublime-security#4513] added rule: VIP impersonation…

3d7799e

… with urgent request (strict match, untrusted sender)

github-actions Bot added a commit to IndiaAce/sublime-rules that referenced this pull request May 20, 2026

[Test Rules] [PR sublime-security#4513] added rule: VIP impersonation…

aff402d

… with w2 request with reply-to mismatch

github-actions Bot added a commit to IndiaAce/sublime-rules that referenced this pull request May 20, 2026

[Test Rules] [PR sublime-security#4513] added rule: VIP / Executive i…

446f992

…mpersonation (strict match, untrusted)

github-actions Bot added a commit that referenced this pull request May 20, 2026

[Shared Samples] [PR #4513] added rule: PR# 4513 - VIP impersonation …

7be338f

…with BEC language (near match, untrusted sender)

github-actions Bot added a commit that referenced this pull request May 20, 2026

[Shared Samples] [PR #4513] added rule: PR# 4513 - VIP impersonation …

087ec11

…with invoicing request

github-actions Bot added a commit that referenced this pull request May 20, 2026

[Shared Samples] [PR #4513] added rule: PR# 4513 - VIP impersonation …

8253161

…with urgent request (strict match, untrusted sender)

github-actions Bot added a commit that referenced this pull request May 20, 2026

[Shared Samples] [PR #4513] added rule: PR# 4513 - VIP impersonation …

f83a47a

…with w2 request with reply-to mismatch

github-actions Bot added a commit that referenced this pull request May 20, 2026

[Shared Samples] [PR #4513] added rule: PR# 4513 - VIP / Executive im…

b11b351

…personation (strict match, untrusted)

rw-access reviewed May 20, 2026

View reviewed changes

IndiaAce and others added 2 commits May 29, 2026 15:03

Auto-format MQL and add rule IDs

8edfcb1

github-actions Bot added a commit that referenced this pull request May 29, 2026

[Test Rules] [PR #4513] modified rule: VIP impersonation with BEC lan…

d416899

…guage (near match, untrusted sender)

github-actions Bot added a commit that referenced this pull request May 29, 2026

[Test Rules] [PR #4513] modified rule: VIP impersonation with invoici…

3b4c404

…ng request

github-actions Bot added a commit that referenced this pull request May 29, 2026

[Test Rules] [PR #4513] modified rule: VIP impersonation with urgent …

8dd6e60

…request (strict match, untrusted sender)

github-actions Bot added a commit that referenced this pull request May 29, 2026

[Test Rules] [PR #4513] modified rule: VIP impersonation with w2 requ…

4273a2e

…est with reply-to mismatch

github-actions Bot added a commit that referenced this pull request May 29, 2026

[Test Rules] [PR #4513] modified rule: VIP / Executive impersonation …

aac667b

…(strict match, untrusted)

github-actions Bot added a commit to IndiaAce/sublime-rules that referenced this pull request May 29, 2026

[Test Rules] [PR sublime-security#4513] modified rule: VIP impersonat…

0da69cc

…ion with BEC language (near match, untrusted sender)

github-actions Bot added a commit to IndiaAce/sublime-rules that referenced this pull request May 29, 2026

[Test Rules] [PR sublime-security#4513] modified rule: VIP impersonat…

9c3edde

…ion with invoicing request

github-actions Bot added a commit that referenced this pull request May 29, 2026

[Shared Samples] [PR #4513] modified rule: PR# 4513 - VIP / Executive…

4eaadb6

… impersonation (strict match, untrusted)

IndiaAce and others added 2 commits May 29, 2026 16:23

Auto-format MQL and add rule IDs

4e4a776

github-actions Bot added a commit to IndiaAce/sublime-rules that referenced this pull request May 29, 2026

[Test Rules] [PR sublime-security#4513] modified rule: VIP impersonat…

645db24

…ion with BEC language (near match, untrusted sender)

github-actions Bot added a commit to IndiaAce/sublime-rules that referenced this pull request May 29, 2026

[Test Rules] [PR sublime-security#4513] modified rule: VIP impersonat…

29ce4cb

…ion with invoicing request

github-actions Bot added a commit to IndiaAce/sublime-rules that referenced this pull request May 29, 2026

[Test Rules] [PR sublime-security#4513] modified rule: VIP impersonat…

b56330e

…ion with urgent request (strict match, untrusted sender)

github-actions Bot added a commit to IndiaAce/sublime-rules that referenced this pull request May 29, 2026

[Test Rules] [PR sublime-security#4513] modified rule: VIP impersonat…

c08f806

…ion with w2 request with reply-to mismatch

github-actions Bot added a commit to IndiaAce/sublime-rules that referenced this pull request May 29, 2026

[Test Rules] [PR sublime-security#4513] modified rule: VIP / Executiv…

357ef4b

…e impersonation (strict match, untrusted)

github-actions Bot added a commit that referenced this pull request May 29, 2026

[Shared Samples] [PR #4513] modified rule: PR# 4513 - VIP impersonati…

07e0b35

…on with BEC language (near match, untrusted sender)

github-actions Bot added a commit that referenced this pull request May 29, 2026

[Shared Samples] [PR #4513] modified rule: PR# 4513 - VIP impersonati…

6b3dfc5

…on with invoicing request

github-actions Bot added a commit that referenced this pull request May 29, 2026

[Shared Samples] [PR #4513] modified rule: PR# 4513 - VIP impersonati…

5d904c1

…on with urgent request (strict match, untrusted sender)

github-actions Bot added a commit that referenced this pull request May 29, 2026

[Shared Samples] [PR #4513] modified rule: PR# 4513 - VIP impersonati…

41b1ff7

…on with w2 request with reply-to mismatch

github-actions Bot added a commit that referenced this pull request May 29, 2026

[Shared Samples] [PR #4513] modified rule: PR# 4513 - VIP / Executive…

2474f85

… impersonation (strict match, untrusted)

github-actions Bot added a commit that referenced this pull request May 29, 2026

[Test Rules] [PR #4513] modified rule: VIP impersonation with BEC lan…

54cb9ce

…guage (near match, untrusted sender)

github-actions Bot added a commit that referenced this pull request May 29, 2026

[Test Rules] [PR #4513] modified rule: VIP impersonation with invoici…

438e0b2

…ng request

github-actions Bot added a commit that referenced this pull request May 29, 2026

[Test Rules] [PR #4513] modified rule: VIP impersonation with urgent …

b3115cc

…request (strict match, untrusted sender)

github-actions Bot added a commit that referenced this pull request May 29, 2026

[Test Rules] [PR #4513] modified rule: VIP impersonation with w2 requ…

741f832

…est with reply-to mismatch

github-actions Bot added a commit that referenced this pull request May 29, 2026

[Test Rules] [PR #4513] modified rule: VIP / Executive impersonation …

69811da

…(strict match, untrusted)

IndiaAce and others added 2 commits June 8, 2026 12:17

Guard org_vips name concat against empty first_name/last_name fields

7154940

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Auto-format MQL and add rule IDs

14caf0d

github-actions Bot added a commit that referenced this pull request Jun 8, 2026

[Shared Samples] [PR #4513] modified rule: PR# 4513 - VIP impersonati…

f600624

…on with BEC language (near match, untrusted sender)

github-actions Bot added a commit that referenced this pull request Jun 8, 2026

[Shared Samples] [PR #4513] modified rule: PR# 4513 - VIP impersonati…

ddb0772

…on with invoicing request

github-actions Bot added a commit that referenced this pull request Jun 8, 2026

[Shared Samples] [PR #4513] modified rule: PR# 4513 - VIP impersonati…

dfb6493

…on with urgent request (strict match, untrusted sender)

github-actions Bot added a commit that referenced this pull request Jun 8, 2026

[Shared Samples] [PR #4513] modified rule: PR# 4513 - VIP impersonati…

9d311c6

…on with w2 request with reply-to mismatch

github-actions Bot added a commit that referenced this pull request Jun 8, 2026

[Shared Samples] [PR #4513] modified rule: PR# 4513 - VIP / Executive…

fa05e05

… impersonation (strict match, untrusted)

github-actions Bot added a commit that referenced this pull request Jun 8, 2026

[Test Rules] [PR #4513] modified rule: VIP impersonation with BEC lan…

bade8a6

…guage (near match, untrusted sender)

github-actions Bot added a commit that referenced this pull request Jun 8, 2026

[Test Rules] [PR #4513] modified rule: VIP impersonation with invoici…

17675cb

…ng request

github-actions Bot added a commit that referenced this pull request Jun 8, 2026

[Test Rules] [PR #4513] modified rule: VIP impersonation with urgent …

162624e

…request (strict match, untrusted sender)

github-actions Bot added a commit that referenced this pull request Jun 8, 2026

[Test Rules] [PR #4513] modified rule: VIP impersonation with w2 requ…

728e73b

…est with reply-to mismatch

github-actions Bot added a commit that referenced this pull request Jun 8, 2026

[Test Rules] [PR #4513] modified rule: VIP / Executive impersonation …

0a653eb

…(strict match, untrusted)

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Add first_name/last_name concat matching to org_vips sender rules#4513

Add first_name/last_name concat matching to org_vips sender rules#4513
IndiaAce wants to merge 8 commits into
sublime-security:mainfrom
IndiaAce:india.fn.na.org_vips_name_ordering_sender

IndiaAce commented May 20, 2026

Uh oh!

rw-access May 20, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Conversation

IndiaAce commented May 20, 2026

Description

Affected rules

Associated samples

Associated hunts

Uh oh!

rw-access May 20, 2026

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants