Update impersonation_netflix.yml

sublime-security · Sep 18, 2023 · 30fad59 · 30fad59
1 parent 574b4f4
commit 30fad59
Showing 1 changed file with 6 additions and 4 deletions.
diff --git a/detection-rules/impersonation_netflix.yml b/detection-rules/impersonation_netflix.yml
@@ -29,14 +29,16 @@ source: |
         strings.icontains(body.current_thread.text, "expir"),
         strings.icontains(body.current_thread.text, "payment")
       )
-      and length(body.links) > 0
-      and not any(body.links,
-                  .href_url.domain.root_domain in ("netflix.com", "dvd.com", "netflixfamily.com")
-      )
     )
   )
+  and length(body.links) > 0
+  and not any(body.links,
+              .href_url.domain.root_domain in ("netflix.com", "dvd.com", "netflixfamily.com")
+  )
+  
   and sender.email.domain.root_domain not in ('netflix.com', 'dvd.com', 'netflixfamily.com')
   and sender.email.email not in $recipient_emails
+
 attack_types:
   - "Credential Phishing"
 tactics_and_techniques: