diff --git a/detection-rules/spam_fake_dating_profile.yml b/detection-rules/spam_fake_dating_profile.yml index 9f2e7fcfa0d..9bab1ff1a80 100644 --- a/detection-rules/spam_fake_dating_profile.yml +++ b/detection-rules/spam_fake_dating_profile.yml @@ -13,11 +13,32 @@ source: | any(.href_url.query_params_decoded["email"], strings.parse_email(.).email in map(recipients.to, .email.email) ) + or any([.href_url.path, .display_text], + strings.ilike(., + "*Flirt*", + "*Singles*", + "*Dating*", + "*Girls*", + "*Women*", + "*Screw*", + "*Hook*up*", + "*Reply*", + "*Message*" + ) + ) ) and ( any(ml.nlu_classifier(body.current_thread.text).entities, .name == "org" - and strings.ilike(.text, "*Date*", "*Dating*", "*Girls*", "*Love*") + and strings.ilike(.text, + "*Flirt*", + "*Singles*", + "*Date*", + "*Dating*", + "*Girls*", + "*Love*", + "*Hook*up*" + ) ) or any(ml.nlu_classifier(body.current_thread.text).topics, .name == "Romance") )