Merge branch 'main' into morriscode-patch-2

sublime-security · Sep 20, 2023 · ad89c55 · ad89c55
2 parents 5b75f1f + 822924b
commit ad89c55
Showing 1 changed file with 6 additions and 1 deletion.
diff --git a/detection-rules/body_business_email_compromise_new_sender.yml b/detection-rules/body_business_email_compromise_new_sender.yml
@@ -10,7 +10,12 @@ source: |
   )
   // negating legit replies
   and not (
-    strings.istarts_with(subject.subject, "RE:")
+    (
+      strings.istarts_with(subject.subject, "RE:")
+      // out of office auto-reply
+      // the NLU model will handle these better natively soon
+      or strings.istarts_with(subject.subject, "Automatic reply:")
+    )
     and (
       length(headers.references) > 0
       or any(headers.hops, any(.fields, strings.ilike(.name, "In-Reply-To")))