sublime-rules issues

Create bec_previous_threaded_email_in_sender_local.yml

# Description New BEC Coverage # Associated samples - [Sample 1](https://platform.sublime.security/messages/4f4dedc792970ef762f98fe152cc6221d75856130b56b09ac8e97e07c62d6c2b?preview_id=0198757d-1ed6-7c8f-8dbf-febc59fa70a8) ## Associated hunts - [Hunt 1](https://platform.sublime.security/messages/hunt?huntId=019958a0-6e65-7bf5-90b0-455f66260c16)

morriscode

in-test-rules

Create google_appsheet_abuse_suspicious_url_display_name.yml

1

# Description Google Appsheet abuse ## Associated hunts - [Hunt 1](https://platform.sublime.security/messages/hunt?huntId=0199527a-13dc-7e55-b630-b48e7f028c5e)

morriscode

in-test-rules

Create fuzzy_attack_spam.yml

New test rule for spam content using fuzzy attack score.

markmsublime

in-test-rules

do-not-merge

Create fuzzy_attack_malicious.yml

1

New test rule for malicious content using fuzzy attack score.

markmsublime

in-test-rules

do-not-merge

Create fuzzy_attack_graymail.yml

New test rule for graymail content using fuzzy attack score.

markmsublime

in-test-rules

do-not-merge

Update impersonation_ms_teams_invite.yml

# Description Expanded scope to cover samples below. # Associated samples - [Sample 1](https://platform.sublime.security/messages/4f8ffc9a099ee62425e76ecd0682fa2f8c079f06cc6f7d65521c660a844109c4?preview_id=0199b93f-cc48-7b81-9911-7f2a750c9d25) ## Associated hunts - [Hunt 1](https://platform.sublime.security/hunts/0199c4b1-8812-76f3-b491-fb37a1aa2b3b) - hunt with new logic, finds more samples as well

markmsublime

in-test-rules

Create brand_impersonation_xfinity.yml

# Description Detects messages impersonating Xfinity or Comcast through subject lines, display names, or body content that contains credential theft or advance fee fraud indicators, while excluding legitimate communications from...

markmsublime

in-test-rules

Create headers_kagoya.yml

# Description Message contains kagoya.net domain in the email headers, indicating routing through Kagoya Internet Routing services. ## Associated hunts - [Hunt 1](https://platform.sublime.security/messages/hunt?huntId=01999d1d-7db9-7b2a-9de2-54aeb6f66659)

markmsublime

in-test-rules

bump

Testing https://github.com/sublime-security/sublime-rules/pull/3397

cameron-dunn-sublime

Create impersonation_openai.yml

12

# Description This rule is designed to identify suspicious OpenAI style phishing content, using both logo detect (TBD) and levenshtein logic to determine whether brand impersonation is present. Including the...

brycampbell

in-test-rules

sublime-rules
sublime-rules copied to clipboard

Metadata

Create bec_previous_threaded_email_in_sender_local.yml

Create google_appsheet_abuse_suspicious_url_display_name.yml

Create fuzzy_attack_spam.yml

Create fuzzy_attack_malicious.yml

Create fuzzy_attack_graymail.yml

Update impersonation_ms_teams_invite.yml

Create brand_impersonation_xfinity.yml

Create headers_kagoya.yml

bump

Create impersonation_openai.yml

← Metadata

Owner

Metadata

sublime-rules sublime-rules copied to clipboard

Metadata

← Metadata

Owner

Metadata

sublime-rules
sublime-rules copied to clipboard