Update impersonation_amazon.yml (#762)

morriscode · web-flow · commit ef1a7aa3b10b · 2023-09-01T18:25:24.000Z
diff --git a/detection-rules/impersonation_amazon.yml b/detection-rules/impersonation_amazon.yml
@@ -14,7 +14,7 @@ source: |
   )
   and (
     regex.icontains(sender.display_name,
-                    '\b[aaa𝝰aａ𝑎𝗮𝕒𝖆𝓪𝚊𝞪аɑα𝔞𝒂𝘢𝛂⍺𝒶𝙖𝜶𝛼𝐚𝖺]maz[o0]n\s?(pay|marketplace|\.com)'
+                    '\b[aaa𝝰aａ𝑎𝗮𝕒𝖆𝓪𝚊𝞪аɑα𝔞𝒂𝘢𝛂⍺𝒶𝙖𝜶𝛼𝐚𝖺]maz[o0]n\s?(pay|marketplace|\.com)|ᵃ⤻ᶻ'
     )
     or strings.ilevenshtein(sender.display_name, 'amazon.com') <= 1
     or strings.ilevenshtein(sender.display_name, 'amazon pay') <= 1

Original file line number	Diff line number	Diff line change
`@@ -14,7 +14,7 @@ source: \|`
`14`	`14`	`)`
`15`	`15`	`and (`
`16`	`16`	`regex.icontains(sender.display_name,`
`17`		`- '\b[aaa𝝰aａ𝑎𝗮𝕒𝖆𝓪𝚊𝞪аɑα𝔞𝒂𝘢𝛂⍺𝒶𝙖𝜶𝛼𝐚𝖺]maz[o0]n\s?(pay\|marketplace\|\.com)'`
	`17`	`+ '\b[aaa𝝰aａ𝑎𝗮𝕒𝖆𝓪𝚊𝞪аɑα𝔞𝒂𝘢𝛂⍺𝒶𝙖𝜶𝛼𝐚𝖺]maz[o0]n\s?(pay\|marketplace\|\.com)\|ᵃ⤻ᶻ'`
`18`	`18`	`)`
`19`	`19`	`or strings.ilevenshtein(sender.display_name, 'amazon.com') <= 1`
`20`	`20`	`or strings.ilevenshtein(sender.display_name, 'amazon pay') <= 1`