sublime-rules
sublime-rules copied to clipboard
Update spam_attendee_list_solicitation.yml
Description
Wrapped positive identifiers in an X of statement. Added two more positive identifiers to the X of statement; one for if the sender is using a free email provider, and one to detect if the local part of the sender's email contains a suspicious substring.
Associated samples
Associated hunts
- https://na-west.platform.sublime.security/hunts/01973cab-9daf-7b3e-aa4c-b87e911bc190
HI @chrome-penguin, are you able to resolve the conflicts here?