Skip to content

Update attachment_fake_attachment_image.yml #2692

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Open
wants to merge 2 commits into
base: main
Choose a base branch
from
Open

Update attachment_fake_attachment_image.yml #2692

wants to merge 2 commits into from

Conversation

aidenmitchell
Copy link
Member

Description

This pull request introduces an enhancement to the detection logic in the detection-rules/attachment_fake_attachment_image.yml file. The update expands the detection criteria for identifying fake attachment images by analyzing message screenshots and refining the message body checks.

Enhancements to detection logic:

  • Added a new condition to detect fake attachments based on the presence of the "FakeAttachment" brand in logos detected within message screenshots.
  • Improved message body analysis by adding checks for:
    • Text length being less than 2000 characters.
    • The presence of phrases like "sent you."
    • A regex pattern to identify filesize strings (e.g., "2.5 MB").

Associated samples

@aidenmitchell aidenmitchell requested a review from a team as a code owner May 9, 2025 16:12
@aidenmitchell aidenmitchell added the in-test-rules PR is in our testing suite to collect telemetry label May 9, 2025
@aidenmitchell
Copy link
Member Author

/update-test-rules

github-actions bot pushed a commit that referenced this pull request May 9, 2025
Sync from PR#2692
f7fab41 
Update attachment_fake_attachment_image.yml by @aidenmitchell
#2692
Source SHA b205f17
Triggered by @aidenmitchell
@aidenmitchell
Copy link
Member Author

/update-test-rules

github-actions bot pushed a commit that referenced this pull request May 9, 2025
Sync from PR#2692
6bf3b01 
Update attachment_fake_attachment_image.yml by @aidenmitchell
#2692
Source SHA e3df478
Triggered by @aidenmitchell
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers
No reviews
Assignees
No one assigned
Labels
in-test-rules PR is in our testing suite to collect telemetry
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
1 participant
@aidenmitchell