Updating rule: attachment_any_html_unsolicited.yml (#855)

sublime-security · Oct 13, 2023 · a0a8541 · a0a8541
1 parent 68f430f
commit a0a8541
Showing 1 changed file with 2 additions and 5 deletions.
diff --git a/detection-rules/attachment_any_html_unsolicited.yml b/detection-rules/attachment_any_html_unsolicited.yml
@@ -12,11 +12,8 @@ source: |
   type.inbound
   and any(attachments, .file_extension in~ ('htm', 'html') or .file_type == "html")
   and (
-    not profile.by_sender().solicited
-    or (
-      profile.by_sender().any_messages_malicious_or_spam
-      and not profile.by_sender().any_false_positives
-    )
+    not profile.by_sender().any_false_positives
+    and not profile.by_sender().solicited
   )
 tags:
   - "Attack surface reduction"