[Shared Samples] [PR #3984] modified rule: PR# 3984 - Brand impersonation: DocuSign

github-actions[bot] · github-actions[bot] · commit 3721b90c2594 · 2026-02-18T17:03:14.000Z
diff --git a/detection-rules/3984_impersonation_docusign.yml b/detection-rules/3984_impersonation_docusign.yml
@@ -310,7 +310,7 @@ source: |
   and (
     any(
         // filter links that match docusign wording
-        filter(body.current_thread.links,
+        filter(body.links,
                // we've observed invisible characters in the display name
                // such as U+034F: "Revi\x{034F}ew Now"
                (

Original file line number	Diff line number	Diff line change
`@@ -310,7 +310,7 @@ source: \|`
`310`	`310`	`and (`
`311`	`311`	`any(`
`312`	`312`	`// filter links that match docusign wording`
`313`		`- filter(body.current_thread.links,`
	`313`	`+ filter(body.links,`
`314`	`314`	`// we've observed invisible characters in the display name`
`315`	`315`	`// such as U+034F: "Revi\x{034F}ew Now"`
`316`	`316`	`(`