Update suspicious_request_financial.yml (#3082)

ben-sublime · web-flow · commit 37de11893d8b · 2025-08-14T17:33:04.000Z
diff --git a/detection-rules/suspicious_request_financial.yml b/detection-rules/suspicious_request_financial.yml
@@ -27,7 +27,7 @@ source: |
     )
     or regex.icontains(body.current_thread.text,
                        '\b(Aged|Age?ing) (Payables|Receivables|Report)',
-                       'updated (\bAR\b|accounts? (Payables|Receivables))'
+                       '(updated|recent) (\bAR\b|\b\AP\b|\bAR\b \& \bAP\b|accounts?) (Payables|Receivables|Reports)'
     )
   )
   and (

Original file line number	Diff line number	Diff line change
`@@ -27,7 +27,7 @@ source: \|`
`27`	`27`	`)`
`28`	`28`	`or regex.icontains(body.current_thread.text,`
`29`	`29`	`'\b(Aged\|Age?ing) (Payables\|Receivables\|Report)',`
`30`		`- 'updated (\bAR\b\|accounts? (Payables\|Receivables))'`
	`30`	`+ '(updated\|recent) (\bAR\b\|\b\AP\b\|\bAR\b \& \bAP\b\|accounts?) (Payables\|Receivables\|Reports)'`
`31`	`31`	`)`
`32`	`32`	`)`
`33`	`33`	`and (`