FP Negation: link_credential_phishing_voicemail_language.yml (#783)

sublime-security · Sep 8, 2023 · 71409e9 · 71409e9
1 parent db2a226
commit 71409e9
Showing 1 changed file with 1 addition and 1 deletion.
diff --git a/detection-rules/link_credential_phishing_voicemail_language.yml b/detection-rules/link_credential_phishing_voicemail_language.yml
@@ -25,7 +25,7 @@ source: |
       all(body.links,
           .href_url.domain.root_domain != sender.email.domain.root_domain
           and .href_url.domain.root_domain not in $org_domains
-          and .href_url.domain.root_domain not in ("unitelvoice.com", "googleapis.com")
+          and .href_url.domain.root_domain not in ("unitelvoice.com", "googleapis.com", "dialmycalls.com")
       )
     ),
     (