Add unsolicited (#1009)

sublime-security · Nov 21, 2023 · ef91b1a · ef91b1a
1 parent b306c0f
commit ef91b1a
Showing 1 changed file with 4 additions and 1 deletion.
diff --git a/detection-rules/attachment_any_html_new_sender.yml b/detection-rules/attachment_any_html_new_sender.yml
@@ -12,7 +12,10 @@ source: |
   type.inbound
   and any(attachments, .file_extension in~ ('htm', 'html') or .file_type == "html")
   and (
-    profile.by_sender().prevalence in ("new", "outlier")
+    (
+      profile.by_sender().prevalence in ("new", "outlier")
+      and not profile.by_sender().solicited
+    )
     or profile.by_sender().any_messages_malicious_or_spam
   )
   and not profile.by_sender().any_false_positives