Updating rule: impersonation_amazon.yml (#795)

sublime-security · Sep 18, 2023 · e116d25 · e116d25
1 parent 8a98a85
commit e116d25
Showing 1 changed file with 5 additions and 0 deletions.
diff --git a/detection-rules/impersonation_amazon.yml b/detection-rules/impersonation_amazon.yml
@@ -25,6 +25,11 @@ source: |
       and sender.email.domain.root_domain in $free_email_providers
     )
   )
+  // negate listservs
+  and not (
+      any(headers.hops, any(.fields, .name == "List-Unsubscribe"))
+      and strings.contains(sender.display_name, "via")
+  )
   and sender.email.domain.root_domain not in~ (
     'amazon.com',
     'amazon.com.au',