Update recon_recipients_bccd_undisclosed.yml

zoomequipd · web-flow · commit 9541c7ecac8d · 2026-02-02T18:44:18.000-06:00
diff --git a/detection-rules/recon_recipients_bccd_undisclosed.yml b/detection-rules/recon_recipients_bccd_undisclosed.yml
@@ -15,7 +15,10 @@ source: |
   and (
     length(subject.base) <= 10
     or (
-      strings.ilike(subject.base, "*checking*", "*testing*")
+      (
+        strings.ilike(subject.base, "*checking*", "*testing*")
+        or subject.base == body.current_thread.text
+      )
       and length(subject.base) <= 25
     )
   )

Original file line number	Diff line number	Diff line change
`@@ -15,7 +15,10 @@ source: \|`
`15`	`15`	`and (`
`16`	`16`	`length(subject.base) <= 10`
`17`	`17`	`or (`
`18`		`- strings.ilike(subject.base, "checking", "testing")`
	`18`	`+ (`
	`19`	`+ strings.ilike(subject.base, "checking", "testing")`
	`20`	`+ or subject.base == body.current_thread.text`
	`21`	`+ )`
`19`	`22`	`and length(subject.base) <= 25`
`20`	`23`	`)`
`21`	`24`	`)`