Skip to content

Create brand_impersonation_aquent.yml #3326

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Merged
merged 11 commits into from
Oct 9, 2025
Merged

Create brand_impersonation_aquent.yml #3326

merged 11 commits into from
Oct 9, 2025

Conversation

@markmsublime
Copy link
Member

@markmsublime markmsublime commented Sep 30, 2025 •
edited
Loading

Description

Detects messages impersonating Aquent, a staffing and talent solutions company, by analyzing sender display names and body content for Aquent branding and office addresses from unauthorized domains.

Associated hunts

@markmsublime markmsublime requested a review from a team as a code owner September 30, 2025 20:36
@github-actions github-actions bot added the in-test-rules PR is in our testing suite to collect telemetry label Sep 30, 2025
github-actions bot added a commit that referenced this pull request Sep 30, 2025
@github-actions
[PR #3326] added rule: Brand impersonation: Aquent
549c172
github-actions bot added a commit that referenced this pull request Sep 30, 2025
@github-actions
[PR #3326] modified rule: Brand impersonation: Aquent
554dae4
github-actions bot added a commit that referenced this pull request Oct 1, 2025
@github-actions
[PR #3326] modified rule: Brand impersonation: Aquent
bcea2ad
github-actions bot added a commit that referenced this pull request Oct 3, 2025
@github-actions
[PR #3326] modified rule: Brand impersonation: Aquent
2f626fc
github-actions bot added a commit that referenced this pull request Oct 6, 2025
@github-actions
[PR #3326] modified rule: Brand impersonation: Aquent
6325b65
github-actions bot added a commit that referenced this pull request Oct 6, 2025
@github-actions
[PR #3326] modified rule: Brand impersonation: Aquent
7cbef0e
@markmsublime
Copy link
Member Author

Test rules and hunts look really good. Marking ready for review.

@markmsublime markmsublime enabled auto-merge October 6, 2025 20:20
@markmsublime markmsublime added the review-needed Indicates that a PR is waiting for review label Oct 6, 2025
@markmsublime markmsublime removed the review-needed Indicates that a PR is waiting for review label Oct 7, 2025
github-actions bot added a commit that referenced this pull request Oct 7, 2025
@github-actions
[PR #3326] modified rule: Brand impersonation: Aquent
735c070
github-actions bot added a commit that referenced this pull request Oct 7, 2025
@github-actions
[PR #3326] modified rule: Brand impersonation: Aquent
d60d2bf
github-actions bot added a commit that referenced this pull request Oct 7, 2025
@github-actions
[PR #3326] Delete detection rule
681c655
github-actions bot added a commit that referenced this pull request Oct 7, 2025
@github-actions
[PR #3326] added rule: Brand impersonation: Aquent
9aed115
@markmsublime markmsublime added the review-needed Indicates that a PR is waiting for review label Oct 9, 2025
@markmsublime markmsublime added this pull request to the merge queue Oct 9, 2025
Merged via the queue into main with commit b30d13b Oct 9, 2025
3 checks passed
@markmsublime markmsublime deleted the markmsublime-patch-12 branch October 9, 2025 21:36
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@zoomequipd zoomequipd zoomequipd approved these changes

Assignees

No one assigned

Labels

in-test-rules PR is in our testing suite to collect telemetry review-needed Indicates that a PR is waiting for review

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

@markmsublime @zoomequipd