Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

New Rule: QR Code with suspicious indicators #817

Merged
merged 8 commits into from
Oct 5, 2023
Merged

New Rule: QR Code with suspicious indicators #817

merged 8 commits into from
Oct 5, 2023

Conversation

morriscode
Copy link
Member

@morriscode morriscode commented Sep 23, 2023

1075 messages found
806 Already Flagged

This is a massive gap filler. It's been running in sharedemls for a few weeks with no FP's.

@morriscode morriscode requested a review from a team September 23, 2023 00:47
@morriscode
Copy link
Member Author

morriscode commented Sep 23, 2023

Numbers reduced to 647 messages found 561 Already Flagged when you add the sender profile.
However we don't traditionally take actions, so we haven't properly flagged attacks as TP/FP in that env.

…code_suspicious_indicators.yml

Revising rule to incorporate message screenshot
@morriscode
Copy link
Member Author

morriscode commented Sep 23, 2023

/update-test-rules

**actually cancelling test-rules, want to ensure message screenshot will not be an issue

@morriscode
Copy link
Member Author

FYI this is on hold for sender_profiles release.

@morriscode morriscode enabled auto-merge (squash) October 5, 2023 15:49
@morriscode morriscode merged commit 1dc009e into sublime-security:main Oct 5, 2023
3 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants