Create monday_infra_abuse.yml #2729
Conversation
peterdj45
added
the
in-test-rules
|
/update-test-rules |
Create monday_infra_abuse.yml by @peterdj45 #2729 Source SHA af107e7 Triggered by @peterdj45
|
I may be missing something but the samples provided above didn't match the rule itself or maybe I'm not doing something right lol. At least the first two samples also didn't have any attachments but did have the |
Ah, those were sent via salesforce and are hitting our high trust sender domain negation. I added an |
|
The OR on line 97 is unencapsulated |
|
I incorporated a topic check to filter out B2B cold outreach, and fixed the unencapsulated OR. I'll let this bake in test-rules over the weekend |
use monday_tracker url decoder unnest the or statements that use different attachment length logic to be their own
Co-authored-by: Luke Wescott <69780712+IndiaAce@users.noreply.github.com>
5 participants
Description
Detects unauthorized use of Monday.com tracking links in messages, attachments, or QR codes from unusual senders who lack proper authentication. Excludes legitimate replies and messages from trusted domains with valid DMARC.
Associated samples