[PR #3487] modified rule: Brand impersonation: Greenvelope

Author: github-actions[bot]

detection-rules/3487_brand_impersonation_greenvelope.yml

@@ -48,8 +48,10 @@ source: |
   
   // avoid fwd/replies
   and not (
-    (subject.is_forward or subject.is_reply)
-    or (length(headers.references) != 0 or headers.in_reply_to is not null)
+    subject.is_forward 
+    or subject.is_reply
+    or length(headers.references) != 0 
+    or headers.in_reply_to is not null
     or length(body.previous_threads) > 0
   )
   
@@ -66,4 +68,4 @@ detection_methods:
 id: "07bf6342-6504-5dc2-b2d7-9a84556fd9d5"
 og_id: "9cbbf9b8-a44a-5d86-8caa-3aef898841c1"
 testing_pr: 3487
-testing_sha: 7e33c77d5cb56e28ee0419e883668da51cb34cec
+testing_sha: fe652c4a13a00e665cf675fcb5269cd4f590a70f