FP fix: file_sharing_link_suspicious_subject.yml (#1049)

sublime-security · Nov 29, 2023 · 608b37b · 608b37b
1 parent c797e4f
commit 608b37b
Showing 1 changed file with 5 additions and 0 deletions.
diff --git a/detection-rules/file_sharing_link_suspicious_subject.yml b/detection-rules/file_sharing_link_suspicious_subject.yml
@@ -7,6 +7,11 @@ severity: "medium"
 source: |
   type.inbound
   and sender.email.domain.root_domain != 'google.com'
+  and not (
+    sender.email.domain.root_domain == "dropbox.com"
+    and any(distinct(headers.hops, .authentication_results.dmarc is not null),
+            strings.ilike(.authentication_results.dmarc, "*pass")
+  ))
   and any(body.links,
           (
             .href_url.domain.domain in $free_file_hosts