Revert "Changes to Docusign rule to reduce false positives." (#1085)

sublime-security · Dec 5, 2023 · fe1588e · fe1588e
1 parent 7a48130
commit fe1588e
Showing 1 changed file with 1 addition and 2 deletions.
diff --git a/detection-rules/credential_phishing_docusign_embedded_image_lure.yml b/detection-rules/credential_phishing_docusign_embedded_image_lure.yml
@@ -5,8 +5,7 @@ severity: "high"
 source: |
   type.inbound
   and length(attachments) <= 1
-  and length(body.links) > 0
-  and all(body.links,
+  and any(body.links,
           not strings.ilike(.href_url.domain.root_domain, "docusign.*")
   )
   and (