Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

New Rule (Attachment): Fake attachment image lure #723

Merged
merged 9 commits into from
Dec 11, 2023
Merged

New Rule (Attachment): Fake attachment image lure #723

merged 9 commits into from
Dec 11, 2023

Conversation

aidenmitchell
Copy link
Member

@aidenmitchell aidenmitchell commented Aug 25, 2023 •
edited
Loading

Uses beta.parse_eml, so can't merge until that's live.

@aidenmitchell aidenmitchell marked this pull request as draft August 25, 2023 17:25
@notion-workspace
Copy link

Untitled

@notion-workspace
Copy link

1692739826

@aidenmitchell
Copy link
Member Author

aidenmitchell commented Aug 25, 2023 •
edited
Loading

Also added "EML analysis" as a detection method (because of parse_eml.)
Thoughts? Maybe call it something cooler to demonstrate how beautiful parse_eml is.

@aidenmitchell aidenmitchell marked this pull request as ready for review September 25, 2023 14:57
@aidenmitchell aidenmitchell requested a review from a team September 25, 2023 14:57
@morriscode
Copy link
Member

/update-test-rules

@morriscode
Copy link
Member

@aidenmitchell blast from the past.

We could add an additional or any(attachments, .file_type in $file_types_images and any(ml.logo_detect(.).brands, .name =="FakeAttachment")) )

@aidenmitchell aidenmitchell merged commit df55407 into sublime-security:main Dec 11, 2023
3 checks passed
@aidenmitchell aidenmitchell deleted the attachment-fake-image branch December 11, 2023 20:11
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@morriscode morriscode morriscode approved these changes

Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
2 participants
@aidenmitchell @morriscode