Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

New Rule: BEC/Fraud: PenPal Scam #1004

Merged
merged 8 commits into from
Nov 21, 2023
Merged

New Rule: BEC/Fraud: PenPal Scam #1004

merged 8 commits into from
Nov 21, 2023

Conversation

morriscode
Copy link
Member

No description provided.

@morriscode
Copy link
Member Author

This is super specific hunts return the only know bad and no fps

@morriscode morriscode requested a review from a team November 21, 2023 00:06
jkamdjou
jkamdjou approved these changes Nov 21, 2023
View reviewed changes
Copy link
Member

@jkamdjou jkamdjou left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

ideas in case you want to consider adding, defer to you:

  • NLU entity
  • no links or attachments

detection-rules/bec_fraud_penpal_scam.yml Outdated Show resolved Hide resolved
@jkamdjou
Copy link
Member

/update-test-rules

github-actions bot pushed a commit that referenced this pull request Nov 21, 2023
Sync from PR#1004
0ba9d69 
New Rule: BEC/Fraud: PenPal Scam by @morriscode
#1004
Source SHA 5c170e5
Triggered by @jkamdjou
@bfilar
Copy link
Member

bfilar commented Nov 21, 2023

@morriscode perhaps not required, but a:

any(ml.nlu_classifier(body.current_thread.text).entities, .name == "request")

may work as well

@morriscode
Copy link
Member Author

/update-test-rules

@morriscode morriscode enabled auto-merge (squash) November 21, 2023 23:15
@morriscode morriscode merged commit ba5ae14 into main Nov 21, 2023
3 checks passed
@morriscode morriscode deleted the sam.penpal.fraud branch November 21, 2023 23:21
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@jkamdjou jkamdjou jkamdjou approved these changes

Assignees

@jkamdjou jkamdjou

Labels
None yet
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
3 participants
@morriscode @jkamdjou @bfilar