Update credential_phishing_corporate_services_impersonation_with_susp… (#3489)

alexo-nano · aidenmitchell · morriscode · web-flow · commit 498fa0cc667d · 2025-11-18T18:22:30.000Z
Co-authored-by: Aiden Mitchell &lt;me@aidenmitchell.ca&gt;
Co-authored-by: Sam Scholten &lt;sam@sublimesecurity.com&gt;
Co-authored-by: Brandon Murphy &lt;4827852+zoomequipd@users.noreply.github.com&gt;
diff --git a/detection-rules/credential_phishing_corporate_services_impersonation_with_suspicious_link.yml b/detection-rules/credential_phishing_corporate_services_impersonation_with_suspicious_link.yml
@@ -53,7 +53,7 @@ source: |
     // or HR department language found in body via NLU
     or any(ml.nlu_classifier(body.current_thread.text).entities,
            .name in ("org", "sender")
-           and regex.icontains(.text, '\bhr\b', 'human resources')
+           and regex.icontains(.text, '\bhr\b', 'human resources', 'operations department')
     )
   )
   

Original file line number	Diff line number	Diff line change
`@@ -53,7 +53,7 @@ source: \|`
`53`	`53`	`// or HR department language found in body via NLU`
`54`	`54`	`or any(ml.nlu_classifier(body.current_thread.text).entities,`
`55`	`55`	`.name in ("org", "sender")`
`56`		`- and regex.icontains(.text, '\bhr\b', 'human resources')`
	`56`	`+ and regex.icontains(.text, '\bhr\b', 'human resources', 'operations department')`
`57`	`57`	`)`
`58`	`58`	`)`
`59`	`59`