Update impersonation_human_resources.yml (#1181)

sublime-security · Dec 21, 2023 · 4143b79 · 4143b79
1 parent 37751a7
commit 4143b79
Showing 1 changed file with 2 additions and 1 deletion.
diff --git a/detection-rules/impersonation_human_resources.yml b/detection-rules/impersonation_human_resources.yml
@@ -15,7 +15,8 @@ source: |
     or not any(headers.hops, any(.fields, strings.ilike(.name, "In-Reply-To")))
   )
   // Negate common marketing mailers
-  and not regex.icontains(sender.display_name, 'HR (Events|Expert)')
+  and not regex.icontains(sender.display_name, 'HR (Events|Expert|Support Center)|HR and People Operations')
+  
   and (
     (0 < length(body.links) < 10 or length(attachments) > 0)
     // mass-mailer infra abuse results in an inflated link count due to mailer templates that include links for unsubbing, changing preferences, etc.