FP Update: Update attachment_html_recipient_in_javascript_identifiers… (

#820)
sublime-security · Sep 25, 2023 · de9bfce · de9bfce
1 parent 7a7921a
commit de9bfce
Showing 1 changed file with 7 additions and 0 deletions.
diff --git a/detection-rules/attachment_html_recipient_in_javascript_identifiers.yml b/detection-rules/attachment_html_recipient_in_javascript_identifiers.yml
@@ -28,8 +28,15 @@ source: |
                   any(recipients.to,
                       any(..scan.javascript.strings, strings.icontains(., ..email.email))
                   )
+  
+                  // Negating Cisco Secure Email Encryption
+                  and not any(.scan.javascript.strings,
+                              strings.contains(., "Cisco Registered Envelope Service")
+                              and not strings.contains(., "https://res.cisco.com:443")
+                  )
           )
   )
+
 attack_types:
   - "Credential Phishing"
 tactics_and_techniques: