Update impersonation_employee_payroll_fraud.yml (#934)

sublime-security · Nov 7, 2023 · 7d48087 · 7d48087
1 parent e6df7ff
commit 7d48087
Showing 1 changed file with 4 additions and 3 deletions.
diff --git a/detection-rules/impersonation_employee_payroll_fraud.yml b/detection-rules/impersonation_employee_payroll_fraud.yml
@@ -15,13 +15,13 @@ source: |
   )
   and 1 of (
     regex.icontains(body.plain.raw,
-                    '(pay\s?(roll|check|date|day)|direct deposit|\bdd\b|gehalt|salario|salary)'
+                    '(pay\s?(roll|check|date|day)|direct deposit|ACH|\bdd\b|gehalt|salario|salary)'
     ),
     regex.icontains(body.html.inner_text,
-                    '(pay\s?(roll|check|date|day)|direct deposit|\bdd\b|gehalt|salario|salary)'
+                    '(pay\s?(roll|check|date|day)|direct deposit|ACH|\bdd\b|gehalt|salario|salary)'
     ),
     regex.icontains(subject.subject,
-                    '(pay\s?(roll|check|date|day)|direct deposit|\bdd\b|gehalt|salario|salary)'
+                    '(pay\s?(roll|check|date|day)|direct deposit|ACH|\bdd\b|gehalt|salario|salary)'
     )
   )
   and (
@@ -31,6 +31,7 @@ source: |
       and not profile.by_sender().any_false_positives
     )
   )
+
 attack_types:
   - "BEC/Fraud"
 tactics_and_techniques: