Update link_dynamics_form.yml (#2086)

sublime-security · Nov 14, 2024 · 3a2ead9 · 3a2ead9
1 parent 5eef900
commit 3a2ead9
Showing 1 changed file with 9 additions and 4 deletions.
diff --git a/detection-rules/link_dynamics_form.yml b/detection-rules/link_dynamics_form.yml
@@ -10,12 +10,17 @@ source: |
   and any(body.links,
           .href_url.domain.domain in ("ncv.microsoft.com", "customervoice.microsoft.com")
           and ml.link_analysis(.).effective_url.domain.domain == "customervoice.microsoft.com"
-
+  
           // confirm it is a form
-          and any(ml.link_analysis(.).final_dom.links,
-                  .href_url.domain.domain == "cdn.forms.office.net"
+          and (
+            any(ml.link_analysis(.).final_dom.links,
+                .href_url.domain.domain == "cdn.forms.office.net"
+            )
+            or strings.icontains(ml.link_analysis(.).final_dom.raw,
+                                 "cdn.forms.office.net"
+            )
           )
-
+          
           // analyze for credential phishing signals
           and (
             any(file.explode(ml.link_analysis(.).screenshot),