Update suspicious_request_for_quote_or_purchase.yml (#2263)

sublime-security · Jan 3, 2025 · 3cea176 · 3cea176
1 parent 3db16ed
commit 3cea176
Showing 1 changed file with 1 addition and 0 deletions.
diff --git a/detection-rules/suspicious_request_for_quote_or_purchase.yml b/detection-rules/suspicious_request_for_quote_or_purchase.yml
@@ -29,6 +29,7 @@ source: |
       length(headers.reply_to) > 0
       and all(headers.reply_to,
               .email.domain.root_domain != sender.email.domain.root_domain
+              and not .email.domain.root_domain in $org_domains
       )
     )
   )