From b2a007eb1ea67b9ad9fd2ec93945c9ae364d7ac3 Mon Sep 17 00:00:00 2001 From: STG-Tanner <102822322+STG-Tanner@users.noreply.github.com> Date: Thu, 30 Apr 2026 09:59:37 -0500 Subject: [PATCH 1/5] Update detection-rules.json Remove github.io exclusion Signed-off-by: STG-Tanner <102822322+STG-Tanner@users.noreply.github.com> --- rules/detection-rules.json | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/rules/detection-rules.json b/rules/detection-rules.json index a40b660..55a68d0 100644 --- a/rules/detection-rules.json +++ b/rules/detection-rules.json @@ -59,8 +59,7 @@ "^https:\\/\\/[^/]*\\.dynamics\\.com(/.*)?$", "^https:\\/\\/(?:[^/]*\\.)?zoom\\.us(/.*)?$", "^https:\\/\\/github\\.com(/.*)?$", - "^https:\\/\\/[^/]*\\.github\\.com(/.*)?$", - "^https:\\/\\/[^/]*\\.github\\.io(/.*)?$" + "^https:\\/\\/[^/]*\\.github\\.com(/.*)?$" ], "context_indicators": { "description": "Additional context that indicates legitimate discussion vs phishing", From 0771be93d73663da6df4e5cdd16bf45c613ff73e Mon Sep 17 00:00:00 2001 From: Brayden Date: Mon, 20 Jul 2026 11:29:14 -0500 Subject: [PATCH 2/5] Update detection rules and threshold values Added amazonaws.com to the exclusion list. Updated squatting detection threshold. Signed-off-by: Brayden --- rules/detection-rules.json | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/rules/detection-rules.json b/rules/detection-rules.json index ad01d82..cd454a6 100644 --- a/rules/detection-rules.json +++ b/rules/detection-rules.json @@ -60,7 +60,8 @@ "^https:\\/\\/(?:[^/]*\\.)?zoom\\.us(/.*)?$", "^https:\\/\\/github\\.com(/.*)?$", "^https:\\/\\/[^/]*\\.github\\.com(/.*)?$", - "^https:\\/\\/[^/]*\\.github\\.io(/.*)?$" + "^https:\\/\\/[^/]*\\.github\\.io(/.*)?$", + "^https:\\/\\/[^/]*\\.amazonaws\\.com(/.*)?$" ], "context_indicators": { "description": "Additional context that indicates legitimate discussion vs phishing", @@ -2011,7 +2012,7 @@ "domain_squatting": { "description": "Domain squatting detection configuration to protect against typosquatting, homoglyphs, and combosquatting attacks", "action": "block", - "deviation_threshold": 2, + "deviation_threshold": 4, "algorithms": { "levenshtein": true, "homoglyph": true, From 67ed8d6717ef4b3533d792e099904b5031bdf90f Mon Sep 17 00:00:00 2001 From: Brayden Date: Mon, 20 Jul 2026 11:32:26 -0500 Subject: [PATCH 3/5] Add Fox.com to detection rules Signed-off-by: Brayden --- rules/detection-rules.json | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/rules/detection-rules.json b/rules/detection-rules.json index cd454a6..aea452f 100644 --- a/rules/detection-rules.json +++ b/rules/detection-rules.json @@ -61,7 +61,8 @@ "^https:\\/\\/github\\.com(/.*)?$", "^https:\\/\\/[^/]*\\.github\\.com(/.*)?$", "^https:\\/\\/[^/]*\\.github\\.io(/.*)?$", - "^https:\\/\\/[^/]*\\.amazonaws\\.com(/.*)?$" + "^https:\\/\\/[^/]*\\.amazonaws\\.com(/.*)?$", + "^https:\\/\\/[^/]*\\.fox\\.com(/.*)?$" ], "context_indicators": { "description": "Additional context that indicates legitimate discussion vs phishing", From c46f574cbad807830b931d82d76ec4a5c39ae637 Mon Sep 17 00:00:00 2001 From: Brayden Date: Mon, 20 Jul 2026 11:43:00 -0500 Subject: [PATCH 4/5] Added *.googleadservices.com to exclusion list. Our logs are getting filled with this URI as a phishing attempt because it is close to google.com. Signed-off-by: Brayden --- rules/detection-rules.json | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/rules/detection-rules.json b/rules/detection-rules.json index aea452f..be0a194 100644 --- a/rules/detection-rules.json +++ b/rules/detection-rules.json @@ -62,7 +62,8 @@ "^https:\\/\\/[^/]*\\.github\\.com(/.*)?$", "^https:\\/\\/[^/]*\\.github\\.io(/.*)?$", "^https:\\/\\/[^/]*\\.amazonaws\\.com(/.*)?$", - "^https:\\/\\/[^/]*\\.fox\\.com(/.*)?$" + "^https:\\/\\/[^/]*\\.fox\\.com(/.*)?$", + "^https:\\/\\/googleadservices\\.com(/.*)?$" ], "context_indicators": { "description": "Additional context that indicates legitimate discussion vs phishing", From 2c6c9e499fdc859c04fac67e7abeeb4d820d4aa5 Mon Sep 17 00:00:00 2001 From: Brayden Date: Fri, 24 Jul 2026 10:40:12 -0500 Subject: [PATCH 5/5] Refine regex for googleadservices.com detection Signed-off-by: Brayden --- rules/detection-rules.json | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/rules/detection-rules.json b/rules/detection-rules.json index be0a194..cf10c7e 100644 --- a/rules/detection-rules.json +++ b/rules/detection-rules.json @@ -63,7 +63,7 @@ "^https:\\/\\/[^/]*\\.github\\.io(/.*)?$", "^https:\\/\\/[^/]*\\.amazonaws\\.com(/.*)?$", "^https:\\/\\/[^/]*\\.fox\\.com(/.*)?$", - "^https:\\/\\/googleadservices\\.com(/.*)?$" + "^https:\\/\\/(?:[^/]*\\.)?googleadservices\\.com(/.*)?$" ], "context_indicators": { "description": "Additional context that indicates legitimate discussion vs phishing",