Revert "Changes to Docusign rule to reduce false positives. (#1083)"

This reverts commit 7a48130.
sublime-security · Dec 5, 2023 · 371d089 · 371d089
1 parent 7a48130
commit 371d089
Showing 1 changed file with 1 addition and 2 deletions.
diff --git a/detection-rules/credential_phishing_docusign_embedded_image_lure.yml b/detection-rules/credential_phishing_docusign_embedded_image_lure.yml
@@ -5,8 +5,7 @@ severity: "high"
 source: |
   type.inbound
   and length(attachments) <= 1
-  and length(body.links) > 0
-  and all(body.links,
+  and any(body.links,
           not strings.ilike(.href_url.domain.root_domain, "docusign.*")
   )
   and (