Update credential_phishing_corporate_services_impersonation_with_susp… (

#2442)
sublime-security · Feb 27, 2025 · e34fc91 · e34fc91
1 parent 0118088
commit e34fc91
Showing 1 changed file with 1 addition and 1 deletion.
diff --git a/...ction-rules/credential_phishing_corporate_services_impersonation_with_suspicious_link.yml b/...ction-rules/credential_phishing_corporate_services_impersonation_with_suspicious_link.yml
@@ -20,7 +20,7 @@ source: |
     (
       length(subject.subject) > 20
       and regex.icontains(subject.subject,
-                          '(time.{0,4}sheet)|(employ|update(?:d| to)).{0,30}(benefit|handbook|comp\b|compensation|salary|pay(roll)?|policy|conduct|acknowl|PTO|vacation|assess)'
+                          '(time.{0,4}sheet)|(employ|update(?:d| to)).{0,30}(benefit|handbook|comp\b|compensation|salary|pay(roll)?|policy|conduct|acknowl|PTO|vacation|assess|eval)'
       )
     )