Skip to content

Update recon_short_generic_greeting.yml#4566

Merged
zoomequipd merged 4 commits into
mainfrom
zoomequipd.fp.ESC-14472.short_recon_profile
May 29, 2026
Merged

Update recon_short_generic_greeting.yml#4566
zoomequipd merged 4 commits into
mainfrom
zoomequipd.fp.ESC-14472.short_recon_profile

Conversation

@zoomequipd
Copy link
Copy Markdown
Member

@zoomequipd zoomequipd commented May 29, 2026 •
edited
Loading

Description

Objective: Reduce FPs

  1. Address bug in sender profile logic as it related to dmarc
  2. simplify profile logic
  3. reduce FPs for employee --> work message by comparing sender display_name to mailbox first_name and mailbox.last_name (handle for when sender display_name/mailbox elements are null)
  4. add negation for common senders

see ESC for details

@zoomequipd zoomequipd requested a review from a team May 29, 2026 17:01
@zoomequipd zoomequipd requested a review from a team as a code owner May 29, 2026 17:01
@github-actions github-actions Bot added the in-test-rules PR is in our testing suite to collect telemetry label May 29, 2026
github-actions Bot added a commit that referenced this pull request May 29, 2026
@github-actions
[Test Rules] [PR #4566] added rule: Reconnaissance: Short generic gre…
0d10e2a 
…eting message
github-actions Bot added a commit to IndiaAce/sublime-rules that referenced this pull request May 29, 2026
@github-actions
[Test Rules] [PR sublime-security#4566] added rule: Reconnaissance: S…
214d56a 
…hort generic greeting message
github-actions Bot added a commit that referenced this pull request May 29, 2026
@github-actions
[Shared Samples] [PR #4566] added rule: PR# 4566 - Reconnaissance: Sh…
53839b9 
…ort generic greeting message
github-actions Bot added a commit that referenced this pull request May 29, 2026
@github-actions
[Test Rules] [PR #4566] modified rule: Reconnaissance: Short generic …
581613e 
…greeting message
@zoomequipd zoomequipd added the review-needed Indicates that a PR is waiting for review label May 29, 2026
markmsublime
markmsublime approved these changes May 29, 2026
View reviewed changes
Copy link
Copy Markdown
Member

@markmsublime markmsublime left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

we spoke about this offline, aligned with these changes. great solution!

github-actions Bot added a commit to IndiaAce/sublime-rules that referenced this pull request May 29, 2026
@github-actions
[Test Rules] [PR sublime-security#4566] modified rule: Reconnaissance…
5732ebd 
…: Short generic greeting message
@zoomequipd zoomequipd added this pull request to the merge queue May 29, 2026
Merged via the queue into main with commit 53f4c43 May 29, 2026
4 checks passed
@zoomequipd zoomequipd deleted the zoomequipd.fp.ESC-14472.short_recon_profile branch May 29, 2026 19:47
github-actions Bot added a commit that referenced this pull request May 29, 2026
@github-actions
[Shared Samples] [PR #4566] Delete detection rule
443f77d
github-actions Bot added a commit that referenced this pull request May 29, 2026
@github-actions
[Test Rules] [PR #4566] Delete detection rule
02ef058
github-actions Bot added a commit to IndiaAce/sublime-rules that referenced this pull request May 29, 2026
@github-actions
[Test Rules] [PR sublime-security#4566] Delete detection rule
49bcee6
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@markmsublime markmsublime markmsublime approved these changes

Assignees

No one assigned

Labels

in-test-rules PR is in our testing suite to collect telemetry review-needed Indicates that a PR is waiting for review

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

@zoomequipd @markmsublime