Sync from PR#2179

Update link_google_open_redirect_with_suspicious_indicators.yml by @zoomequipd #2179 Source SHA c8b8666 Triggered by @zoomequipd
sublime-security · Dec 30, 2024 · 09fdac6 · 09fdac6
1 parent c89acb8
commit 09fdac6
Showing 1 changed file with 2 additions and 2 deletions.
diff --git a/detection-rules/link_google_open_redirect_with_suspicious_indicators.yml b/detection-rules/link_google_open_redirect_with_suspicious_indicators.yml
@@ -13,7 +13,7 @@ source: |
   // negate auth'ed google messages
   and not (
     sender.email.domain.sld == "google"
-    and sender.email.local_part in ("googlealerts-noreply", "comments-noreply@docs.google.com")
+    and sender.email.local_part in ("googlealerts-noreply", "comments-noreply")
     and headers.auth_summary.spf.pass
     and headers.auth_summary.dmarc.pass
   )
@@ -89,4 +89,4 @@ detection_methods:
   - "URL analysis"
 id: "fc5adf74-6a39-5285-9737-3539a0542313"
 testing_pr: 2179
-testing_sha: 063811fb26c72d00e3e84dd60cd2a53cc16bcd5c
+testing_sha: c8b8666c1d72b1433eee9cb3cd116b527c1e8de4