[PR #3644] modified rule: Brand impersonation: Mimecast

github-actions[bot] · github-actions[bot] · commit 1fa899830b31 · 2026-01-21T03:50:10.000Z
diff --git a/detection-rules/3644_brand_impersonation_mimecast.yml b/detection-rules/3644_brand_impersonation_mimecast.yml
@@ -36,7 +36,7 @@ source: |
            )
     )
   )
-  and all(body.links, .href_url.domain.root_domain not in ("mimecast.com"))
+  and not all(body.links, .href_url.domain.root_domain in ("mimecast.com"))
 attack_types:
   - "Credential Phishing"
 tactics_and_techniques:
@@ -48,4 +48,4 @@ detection_methods:
 id: "37df73e5-18cf-525c-a57f-ab2ea02e1d5d"
 og_id: "fde1930e-800e-530c-a11a-ffd7fee835e5"
 testing_pr: 3644
-testing_sha: 43e9211e6e3311f575c9834c2b99d2a38e215fd9
+testing_sha: 45b9ee7c02cd4c7778cfb70c49e6deb26909ad83

Original file line number	Diff line number	Diff line change
`@@ -36,7 +36,7 @@ source: \|`
`36`	`36`	`)`
`37`	`37`	`)`
`38`	`38`	`)`
`39`		`- and all(body.links, .href_url.domain.root_domain not in ("mimecast.com"))`
	`39`	`+ and not all(body.links, .href_url.domain.root_domain in ("mimecast.com"))`
`40`	`40`	`attack_types:`
`41`	`41`	`- "Credential Phishing"`
`42`	`42`	`tactics_and_techniques:`
`@@ -48,4 +48,4 @@ detection_methods:`
`48`	`48`	`id: "37df73e5-18cf-525c-a57f-ab2ea02e1d5d"`
`49`	`49`	`og_id: "fde1930e-800e-530c-a11a-ffd7fee835e5"`
`50`	`50`	`testing_pr: 3644`
`51`		`-testing_sha: 43e9211e6e3311f575c9834c2b99d2a38e215fd9`
	`51`	`+testing_sha: 45b9ee7c02cd4c7778cfb70c49e6deb26909ad83`