Skip to content

Commit

Permalink
Add known Venmo domain
Browse files Browse the repository at this point in the history
  • Loading branch information
jkamdjou committed Sep 13, 2023
1 parent c4b4232 commit 05f65ad
Showing 1 changed file with 1 addition and 1 deletion.
2 changes: 1 addition & 1 deletion detection-rules/impersonation_venmo.yml
Original file line number Diff line number Diff line change
Expand Up @@ -12,7 +12,7 @@ source: |
or strings.ilevenshtein(sender.display_name, 'venmo') <= 1
or strings.ilike(sender.email.domain.domain, '*venmo*')
)
and sender.email.domain.root_domain not in~ ('venmo.com', 'synchronybank.com', 'venmocreditsurvey.com')
and sender.email.domain.root_domain not in~ ('venmo.com', 'synchronybank.com', 'venmocreditsurvey.com', 'venmo-experience.com')
and sender.email.email not in $recipient_emails
// and not if the sender.display.name contains "via" and dmarc pass from venmo.com
Expand Down

0 comments on commit 05f65ad

Please sign in to comment.