Update sender_ad_distinguished_name.yml (#2069)

sublime-security · Oct 30, 2024 · d138935 · d138935
1 parent ea8668f
commit d138935
Showing 1 changed file with 6 additions and 3 deletions.
diff --git a/detection-rules/sender_ad_distinguished_name.yml b/detection-rules/sender_ad_distinguished_name.yml
@@ -4,9 +4,12 @@ description: |
 type: "rule"
 severity: "medium"
 source: |
-  type.inbound
-  and regex.icontains(sender.display_name, '\b(EX|LABS|OU|CN|EXCHANGE)(=|/)')
-  and sender.email.domain.root_domain not in $org_domains
+    type.inbound
+    and (
+      regex.icontains(sender.display_name, '\b(EX|LABS|OU|CN|EXCHANGE)(=|/)')
+      or strings.icontains(sender.display_name, "/O=EXCHANGELABS")
+    )
+    and sender.email.domain.root_domain not in $org_domains
 tags:
   - "Suspicious sender"
 attack_types: