Skip to content

Add first_name/last_name concat matching to org_vips body/subject rules#4515

Open
IndiaAce wants to merge 2 commits into
sublime-security:mainfrom
IndiaAce:india.fn.na.org_vips_name_ordering_body_subject
Open

Add first_name/last_name concat matching to org_vips body/subject rules#4515
IndiaAce wants to merge 2 commits into
sublime-security:mainfrom
IndiaAce:india.fn.na.org_vips_name_ordering_body_subject

Conversation

@IndiaAce
Copy link
Copy Markdown
Member

Description

Add alternative name matching logic to org_vips body/subject/HTML-based rules to handle cases where
display_name is stored as "Lastname, Firstname" instead of "Firstname Lastname".
Uses strings.concat(.first_name, " ", .last_name) and strings.concat(.last_name, ", ", .first_name)
as additional or conditions inside existing any($org_vips, ...) blocks.

This is a test rule deployment to assess impact magnitude.

Affected rules

  • vip_impersonation_charity.yml
  • fake_thread_suspicious_indicators.yml
  • vip_impersonation_subject.yml
  • vip_impersonation_fake_thread.yml
  • impersonation_google_groups_suspicious.yml
  • service_abuse_trello_board_invite_vip.yml

Associated samples

N/A - validation only (no TP canonical available)

Associated hunts

TBD - will be run after test rule deployment

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
@IndiaAce IndiaAce requested a review from a team May 20, 2026 16:52
@IndiaAce IndiaAce requested a review from a team as a code owner May 20, 2026 16:52
@github-actions github-actions Bot added the in-test-rules PR is in our testing suite to collect telemetry label May 20, 2026
github-actions Bot added a commit that referenced this pull request May 20, 2026
github-actions Bot added a commit that referenced this pull request May 20, 2026
github-actions Bot added a commit that referenced this pull request May 20, 2026
github-actions Bot added a commit that referenced this pull request May 20, 2026
github-actions Bot added a commit that referenced this pull request May 20, 2026
github-actions Bot added a commit to IndiaAce/sublime-rules that referenced this pull request May 20, 2026
github-actions Bot added a commit to IndiaAce/sublime-rules that referenced this pull request May 20, 2026
… via Google Group relay with suspicious indicators
github-actions Bot added a commit to IndiaAce/sublime-rules that referenced this pull request May 20, 2026
…ello board invitation with VIP impersonation
github-actions Bot added a commit to IndiaAce/sublime-rules that referenced this pull request May 20, 2026
github-actions Bot added a commit to IndiaAce/sublime-rules that referenced this pull request May 20, 2026
…: Fake thread with display name match, email mismatch
github-actions Bot added a commit to IndiaAce/sublime-rules that referenced this pull request May 20, 2026
github-actions Bot added a commit that referenced this pull request May 20, 2026
github-actions Bot added a commit that referenced this pull request May 20, 2026
…via Google Group relay with suspicious indicators
github-actions Bot added a commit that referenced this pull request May 20, 2026
…llo board invitation with VIP impersonation
github-actions Bot added a commit that referenced this pull request May 20, 2026
github-actions Bot added a commit that referenced this pull request May 20, 2026
… Fake thread with display name match, email mismatch
github-actions Bot added a commit that referenced this pull request May 20, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

in-test-rules PR is in our testing suite to collect telemetry

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant