Update impersonation_amazon.yml

[peterdj45]

Description

adding logic to sus display name regex to flag subdomain variations (such as amazon.ca, amazon.co.jp)

Associated samples

• https://platform.sublime.security/messages/4f829db9bb0faa991b2e08fb125a01d18f7c7420b9e925a90e36b9f4b93abd8a
• https://platform.sublime.security/messages/4f88a8f95e3eca306d1ff70f08c8304a65ff2d78fe800d9aed2d3a6e7fd9d330
• https://platform.sublime.security/messages/4fd702f9d4cd0ca217ab58c0c2f76087ab5148f4d5b7c1738c3eeddf231e2791

Associated hunts

• https://platform.sublime.security/messages/hunt?huntId=019b349c-6af9-7218-82fd-d2ed9dccf656

[zoomequipd]

I wonder if we can move this to a strings.parse_domain and do subdomain checking? This might handle more of these types of domains more fully

  or any(regex.iextract(sender.display_name,
                        '\b((?:[a-zA-Z0-9][-a-zA-Z0-9]*\.)+[a-zA-Z]{2,})\b'
         ),
         any(.groups, strings.parse_domain(.).sld == "amazon")
  )