diff --git a/detection-rules/callback_phishing_nlu_body_or_attachments.yml b/detection-rules/callback_phishing_nlu_body_or_attachments.yml index 022cf49e0f8..766b372457e 100644 --- a/detection-rules/callback_phishing_nlu_body_or_attachments.yml +++ b/detection-rules/callback_phishing_nlu_body_or_attachments.yml @@ -31,16 +31,6 @@ source: | any(headers.domains, .domain == "smtp-out.gcp.bigcommerce.net") and strings.icontains(body.html.raw, "bigcommerce.com") ) - and ( - ( - profile.by_sender().prevalence in ("new", "outlier") - and not profile.by_sender().solicited - ) - or ( - profile.by_sender().any_messages_malicious_or_spam - and not profile.by_sender().any_false_positives - ) - ) // negate highly trusted sender domains unless they fail DMARC authentication and