Create attachment_pdf_file_banking_payment_from_freemail.yml #3661
+68
−0
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
MSAdministrator
added
the
in-test-rules
github-actions bot
added a commit
that referenced
this pull request
Dec 12, 2025
…ences from freemail sender
Member
Author
MSAdministrator
added
the
review-needed
Member
|
I'm seeing a lot of telemetry in test rules that is marked likely benign here, I'm unable to load the sample sets to SWS but I think this might need some revision. I'm going to remove the |
This was referenced Dec 19, 2025
github-actions bot
added a commit
that referenced
this pull request
Dec 19, 2025
…ferences from freemail sender
github-actions bot
added a commit
that referenced
this pull request
Dec 22, 2025
…ferences from freemail sender
MSAdministrator
added
the
review-needed
zoomequipd
requested changes
Jan 8, 2026
detection-rules/attachment_pdf_file_banking_payment_from_freemail.yml
Outdated
Show resolved
Hide resolved
detection-rules/attachment_pdf_file_banking_payment_from_freemail.yml
Outdated
Show resolved
Hide resolved
detection-rules/attachment_pdf_file_banking_payment_from_freemail.yml
Outdated
Show resolved
Hide resolved
detection-rules/attachment_pdf_file_banking_payment_from_freemail.yml
Outdated
Show resolved
Hide resolved
detection-rules/attachment_pdf_file_banking_payment_from_freemail.yml
Outdated
Show resolved
Hide resolved
Member
|
beyond the suggested changes, where are mostly syntax based, the rule appears to match on a bunch of benign samples. going to remove the |
github-actions bot
added a commit
that referenced
this pull request
Jan 12, 2026
…ferences from freemail sender
MSAdministrator
commented
Jan 12, 2026
detection-rules/attachment_pdf_file_banking_payment_from_freemail.yml
Outdated
Show resolved
Hide resolved
github-actions bot
added a commit
that referenced
this pull request
Jan 12, 2026
…ferences from freemail sender
Member
Author
|
Mode results look good |
MSAdministrator
added
the
review-needed
IndiaAce
reviewed
Jan 13, 2026
detection-rules/attachment_pdf_file_banking_payment_from_freemail.yml
Outdated
Show resolved
Hide resolved
IndiaAce
reviewed
Jan 13, 2026
IndiaAce
reviewed
Jan 13, 2026
detection-rules/attachment_pdf_file_banking_payment_from_freemail.yml
Outdated
Show resolved
Hide resolved
IndiaAce
requested changes
Jan 13, 2026
Member
IndiaAce
left a comment
IndiaAce
left a comment
There was a problem hiding this comment.
one very small nit and something I noticed with your regex... other than that I think this looks good to me!
github-actions bot
added a commit
that referenced
this pull request
Jan 14, 2026
…ferences from freemail sender
Member
|
I'm curious if the regex change is going to have larger impact, I'm going to remove r4r until we get some telemetry in test-ruels |
MSAdministrator
added
the
review-needed
zoomequipd
requested changes
Jan 16, 2026
| ) | ||
| // or any defined org brands like: first.last.sublime@freemail | ||
| or any($org_slds, strings.icontains(sender.email.local_part, .)) | ||
| or any($org_brand_names, strings.icontains(sender.email.local_part, .)) |
Member
There was a problem hiding this comment.
idk the intention of org_brand_names would be common here.
I"m thinking of things like my company org_sld is tcitruck but my entry in org_brand_names is Traffic Consultants Inc
detection-rules/attachment_pdf_file_banking_payment_from_freemail.yml
Outdated
Show resolved
Hide resolved
github-actions bot
added a commit
to aidenmitchell/sublime-rules
that referenced
this pull request
Jan 16, 2026
…h banking and payment references from freemail sender
github-actions bot
added a commit
to aidenmitchell/sublime-rules
that referenced
this pull request
Jan 16, 2026
…nd payment references from freemail sender
github-actions bot
added a commit
to aidenmitchell/sublime-rules
that referenced
this pull request
Jan 16, 2026
github-actions bot
added a commit
to aidenmitchell/sublime-rules
that referenced
this pull request
Jan 16, 2026
github-actions bot
added a commit
to aidenmitchell/sublime-rules
that referenced
this pull request
Jan 16, 2026
…h banking and payment references from freemail sender
github-actions bot
added a commit
to aidenmitchell/sublime-rules
that referenced
this pull request
Jan 16, 2026
…nd payment references from freemail sender
github-actions bot
added a commit
to aidenmitchell/sublime-rules
that referenced
this pull request
Jan 20, 2026
…with banking and payment references from freemail sender
github-actions bot
added a commit
to aidenmitchell/sublime-rules
that referenced
this pull request
Jan 20, 2026
…g and payment references from freemail sender
github-actions bot
added a commit
that referenced
this pull request
Jan 20, 2026
…ferences from freemail sender
Member
Author
|
I'm closing this one in favor of this newer rule #3809 |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
4 participants
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Description
Adding a new rule for coverage of PDFs used for banking/transfer from a freemail provider.
Detects PDF attachments containing banking terminology such as SWIFT codes, account numbers, and payment references from free email providers. These attachments often contain fraudulent payment instructions or fake banking documents used in business email compromise attacks.
Associated samples
Associated hunts