Adding any_fp's as a standalone to ASR rules (#955)

detection-rules/attachment_any_html_in_archive_unsolicited.yml

@@ -17,9 +17,10 @@ source: |
     not profile.by_sender().solicited
     or (
       profile.by_sender().any_messages_malicious_or_spam
-      and not profile.by_sender().any_false_positives
     )
   )
+
+  and not profile.by_sender().any_false_positives
 tags:
   - "Attack surface reduction"
 attack_types:

detection-rules/attachment_any_html_new_sender.yml

@@ -13,11 +13,9 @@ source: |
   and any(attachments, .file_extension in~ ('htm', 'html') or .file_type == "html")
   and (
     profile.by_sender().prevalence in ("new", "outlier")
-    or (
-      profile.by_sender().any_messages_malicious_or_spam
-      and not profile.by_sender().any_false_positives
-    )
+    or profile.by_sender().any_messages_malicious_or_spam
   )
+  and not profile.by_sender().any_false_positives
 
   // negate highly trusted sender domains unless they fail DMARC authentication
   and

detection-rules/attachment_any_html_unsolicited.yml

@@ -12,10 +12,12 @@ source: |
   type.inbound
   and any(attachments, .file_extension in~ ('htm', 'html') or .file_type == "html")
   and (
-    not profile.by_sender().any_false_positives
-    and not profile.by_sender().solicited
+    not profile.by_sender().solicited
+    or profile.by_sender().any_messages_malicious_or_spam
   )
 
+  and not profile.by_sender().any_false_positives
+
   // negate highly trusted sender domains unless they fail DMARC authentication
   and
   (

detection-rules/attachment_disallowed_file_type_in_archive.yml

@@ -197,11 +197,10 @@ source: |
   )
   and (
     profile.by_sender().prevalence in ("new", "outlier")
-    or (
-      profile.by_sender().any_messages_malicious_or_spam
-      and not profile.by_sender().any_false_positives
-    )
+    or profile.by_sender().any_messages_malicious_or_spam
   )
+  and not profile.by_sender().any_false_positives
+  
 tags:
   - "Attack surface reduction"
 attack_types:

detection-rules/attachment_eml_with_html_attachment.yml

@@ -41,15 +41,14 @@ source: |
   // if the "References" is in the body of the message, it's probably a bounce
   and not any(headers.references, strings.contains(body.html.display_text, .))
   and (
-    not profile.by_sender().solicited
-    or (
-      profile.by_sender().any_messages_malicious_or_spam
-      and not profile.by_sender().any_false_positives
-    )
+    profile.by_sender().prevalence in ("new", "outlier")
+    or profile.by_sender().any_messages_malicious_or_spam
   )
+  and not profile.by_sender().any_false_positives
 tags:
   - "Attack surface reduction"
 attack_types:
+
   - "Credential Phishing"
   - "Malware/Ransomware"
 tactics_and_techniques:

detection-rules/attachment_js_file_execution.yml

@@ -17,11 +17,10 @@ source: |
   )
   and (
     profile.by_sender().prevalence in ("new", "outlier")
-    or (
-      profile.by_sender().any_messages_malicious_or_spam
-      and not profile.by_sender().any_false_positives
-    )
+    or profile.by_sender().any_messages_malicious_or_spam
   )
+  and not profile.by_sender().any_false_positives
+  
 tags:
   - "Attack surface reduction"
 attack_types:

detection-rules/link_google_translate.yml

@@ -13,11 +13,10 @@ source: |
   and any(body.links, "google_translate_open_redirect" in .href_url.rewrite.encoders)
   and (
     not profile.by_sender().solicited
-    or (
-      profile.by_sender().any_messages_malicious_or_spam
-      and not profile.by_sender().any_false_positives
-    )
+    or profile.by_sender().any_messages_malicious_or_spam
   )
+
+  and not profile.by_sender().any_false_positives
 tags:
   - "Attack surface reduction"
 attack_types:

detection-rules/link_new_domain_in_link_first_time_sender.yml

@@ -9,11 +9,9 @@ source: |
   and any(body.links, beta.whois(.href_url.domain).days_old <= 10)
   and (
     profile.by_sender().prevalence in ("new", "outlier")
-    or (
-      profile.by_sender().any_messages_malicious_or_spam
-      and not profile.by_sender().any_false_positives
-    )
+    or profile.by_sender().any_messages_malicious_or_spam
   )
+  and not profile.by_sender().any_false_positives
 tags:
   - "Attack surface reduction"
 attack_types:

detection-rules/recipients_undisclosed_free_subdomain_host.yml

@@ -23,11 +23,10 @@ source: |
   )
   and (
     profile.by_sender().prevalence in ("new", "outlier")
-    or (
-      profile.by_sender().any_messages_malicious_or_spam
-      and not profile.by_sender().any_false_positives
-    )
+    or profile.by_sender().any_messages_malicious_or_spam
   )
+  and not profile.by_sender().any_false_positives
+  
 tags:
   - "Attack surface reduction"
 tactics_and_techniques:

detection-rules/sender_new_from_domain_first_time_sender.yml

@@ -8,11 +8,10 @@ source: |
   and beta.whois(sender.email.domain).days_old <= 10
   and (
     profile.by_sender().prevalence in ("new", "outlier")
-    or (
-      profile.by_sender().any_messages_malicious_or_spam
-      and not profile.by_sender().any_false_positives
-    )
+    or profile.by_sender().any_messages_malicious_or_spam
   )
+  and not profile.by_sender().any_false_positives
+  
 tags:
   - "Attack surface reduction"
 detection_methods:

detection-rules/vip_impersonation_attack_surface_reduction.yml

@@ -26,16 +26,15 @@ source: |
     or (
       profile.by_sender().any_messages_malicious_or_spam
       and not profile.by_sender().any_false_positives
-    )
   )
 
   and (
     not profile.by_sender().solicited
-    or (
-      profile.by_sender().any_messages_malicious_or_spam
-      and not profile.by_sender().any_false_positives
+    or profile.by_sender().any_messages_malicious_or_spam
     )
   )
+
+  and not profile.by_sender().any_false_positives
 tags:
   - "Attack surface reduction"
 attack_types: