Update link_credential_phishing_voicemail_language.yml (#880)

sublime-security · Oct 25, 2023 · aaffe1b · aaffe1b
1 parent 99274fa
commit aaffe1b
Showing 1 changed file with 3 additions and 2 deletions.
diff --git a/detection-rules/link_credential_phishing_voicemail_language.yml b/detection-rules/link_credential_phishing_voicemail_language.yml
@@ -29,7 +29,8 @@ source: |
             and .href_url.domain.root_domain not in (
               "unitelvoice.com",
               "googleapis.com",
-              "dialmycalls.com"
+              "dialmycalls.com",
+              "ringcentral.biz"
             )
         )
       ),
@@ -47,7 +48,7 @@ source: |
     )
     
   // negating legit replies and legitimate audio file attachments and known voicemail senders
-  and sender.email.domain.root_domain not in ("magicjack.com", "unitelvoice.com", "voipinterface.net")
+  and sender.email.domain.root_domain not in ("magicjack.com", "unitelvoice.com", "voipinterface.net", "ringcentral.biz")
   and not any(attachments, strings.starts_with(.content_type, "audio"))
     and not (
       (