Update attachment_docusign_image_suspicious_links.yml (#951)

sublime-security · Nov 14, 2023 · 6c5b9a7 · 6c5b9a7
1 parent 3877ec4
commit 6c5b9a7
Showing 1 changed file with 4 additions and 2 deletions.
diff --git a/detection-rules/attachment_docusign_image_suspicious_links.yml b/detection-rules/attachment_docusign_image_suspicious_links.yml
@@ -26,11 +26,13 @@ source: |
           )
   )
   and (
-    profile.by_sender().prevalence in ("new", "outlier")
+    (
+      not profile.by_sender().solicited
+      and profile.by_sender().prevalence in ("new", "outlier")
+    )
     or (
       profile.by_sender().any_messages_malicious_or_spam
       and not profile.by_sender().any_false_positives
-
     )
   )
 attack_types: