[PR #3035] modified rule: Scam: Piano Giveaway

Author: github-actions[bot]

detection-rules/3035_scam_piano.yml

@@ -65,7 +65,9 @@ source: |
                          '* had a passion for music*',
                          '* appreciates music*',
                          "* special piece*",
-                         "* a lot of meaning*"
+                         "* a lot of meaning*",
+                         "* profound sentimental*",
+                         '* will cherish*'
         )
       )
       and (
@@ -84,7 +86,8 @@ source: |
                          '* indicate your interest *',
                          '* to someone you know *',
                          '* know someone who *',
-                         '* someone you know would *'
+                         '* someone you know would *',
+                         '* someone who will *'
         )
         or regex.icontains(body.current_thread.text,
                            'if you[^\r\n]{0,20}(?:(?:might|will|would) be|are)[^\r\n]{0,20}interested',
@@ -177,7 +180,9 @@ source: |
                              '* had a passion for music*',
                              '* appreciates music*',
                              "* special piece*",
-                             "* a lot of meaning*"
+                             "* a lot of meaning*",
+                             "* profound sentimental*",
+                             '* will cherish*'
             )
           )
           and (
@@ -195,7 +200,8 @@ source: |
                              '* indicate your interest *',
                              '* to someone you know *',
                              '* know someone who *',
-                             '* someone you know would *'
+                             '* someone you know would *',
+                             '* someone who will *'
             )
             or regex.icontains(file.parse_text(.).text,
                                'if you[^\r\n]{0,20}(?:(?:might|will|would) be|are)[^\r\n]{0,20}interested',
@@ -240,7 +246,6 @@ source: |
   )
   // person provides piano lessons and offers to give a Roland baby-grand away
   and not sender.email.domain.root_domain == 'ridleyacademy.com'
-
 attack_types:
   - "BEC/Fraud"
 tactics_and_techniques:
@@ -252,4 +257,4 @@ detection_methods:
 id: "23e1ab26-3449-5907-ab19-650797e9c12d"
 og_id: "1a91a203-b1fe-52b7-9f71-cecdbf5cdce0"
 testing_pr: 3035
-testing_sha: af7640680da35aa0d1f3ad7728f1db48febed384
+testing_sha: 9861dd2f8ac484f8407560ac0b28725f1046d641