Updating rule: impersonation_github.yml (#796)

sublime-security · Sep 18, 2023 · bf62f17 · bf62f17
1 parent 3bdf878
commit bf62f17
Showing 1 changed file with 5 additions and 0 deletions.
diff --git a/detection-rules/impersonation_github.yml b/detection-rules/impersonation_github.yml
@@ -13,6 +13,11 @@ source: |
     or strings.ilike(sender.email.email, '*github*')
     or strings.ilevenshtein(sender.email.domain.sld, 'github') <= 1
   )
+  // negating listservs
+  and not (
+      any(headers.hops, any(.fields, .name == "List-Unsubscribe"))
+      and strings.contains(sender.display_name, "via")
+  )
   and sender.email.domain.root_domain not in (
     'github.com',
     'gitlab.com',