Update link_google_open_redirect_with_suspicious_indicators.yml (#2179)

sublime-security · Jan 10, 2025 · d7aee3a · d7aee3a
1 parent 40f3969
commit d7aee3a
Showing 1 changed file with 2 additions and 2 deletions.
diff --git a/detection-rules/link_google_open_redirect_with_suspicious_indicators.yml b/detection-rules/link_google_open_redirect_with_suspicious_indicators.yml
@@ -12,10 +12,10 @@ source: |
     or length(attachments) == 0
   )
   and sender.email.domain.root_domain not in $org_domains
-  // negate auth'ed google alerts
+  // negate auth'ed google messages
   and not (
     sender.email.domain.sld == "google"
-    and sender.email.local_part == "googlealerts-noreply"
+    and sender.email.local_part in ("googlealerts-noreply", "comments-noreply")
     and headers.auth_summary.spf.pass
     and headers.auth_summary.dmarc.pass
   )