Create self_sender_display_name_email_in_subject.yml#4285
Merged
Conversation
github-actions
bot
added
the
in-test-rules
github-actions bot
added a commit
that referenced
this pull request
Mar 31, 2026
…mail and display name in subject
Member
Author
|
This rule is ready. @peterdj45 will review mode results on Monday. |
github-actions bot
added a commit
that referenced
this pull request
Apr 2, 2026
…h email and display name in subject
github-actions bot
added a commit
that referenced
this pull request
Apr 2, 2026
…play name in subject
github-actions bot
added a commit
to IndiaAce/sublime-rules
that referenced
this pull request
Apr 8, 2026
…email and display name in subject
peterdj45
requested changes
Apr 9, 2026
Member
peterdj45
left a comment
peterdj45
left a comment
There was a problem hiding this comment.
Found some FPs in test rules, primarily messages sent via Hearsay Social (social media marketing platform). Example: https://platform.sublime.security/messages/50471e1a18de024481af14a3b2e7f8c8fe9fff30c14456f355e24c6d3234ae4c
Could maybe negate these via presence of X-HearsaySocial headers? or the message ID, which is hearsaysystems.com. Happy to jam on this if you'd like!
Co-authored-by: Peter Djordjevic <116412909+peterdj45@users.noreply.github.com>
github-actions bot
added a commit
that referenced
this pull request
Apr 9, 2026
…play name in subject
github-actions bot
added a commit
to IndiaAce/sublime-rules
that referenced
this pull request
Apr 9, 2026
…th email and display name in subject
github-actions bot
added a commit
that referenced
this pull request
Apr 9, 2026
…h email and display name in subject
github-actions bot
added a commit
that referenced
this pull request
Apr 10, 2026
…rench copy/paste instructions and suspicious domains
github-actions bot
added a commit
that referenced
this pull request
Apr 10, 2026
…e instructions and suspicious domains
github-actions bot
added a commit
to IndiaAce/sublime-rules
that referenced
this pull request
Apr 10, 2026
github-actions bot
added a commit
to IndiaAce/sublime-rules
that referenced
this pull request
Apr 10, 2026
…French copy/paste instructions and suspicious domains
Member
Author
I tightened the rule up more. I have multi-hunts in the ESC. Let me know what you think. Thanks! |
peterdj45
approved these changes
Apr 15, 2026
Member
peterdj45
left a comment
peterdj45
left a comment
There was a problem hiding this comment.
LGTM! left you some non-blocking feedback
…icious_domains.yml Co-authored-by: Peter Djordjevic <116412909+peterdj45@users.noreply.github.com>
…icious_domains.yml Co-authored-by: Peter Djordjevic <116412909+peterdj45@users.noreply.github.com>
…icious_domains.yml Co-authored-by: Peter Djordjevic <116412909+peterdj45@users.noreply.github.com>
github-actions bot
added a commit
that referenced
this pull request
Apr 15, 2026
…structions and suspicious domains (French/Français)
github-actions bot
added a commit
that referenced
this pull request
Apr 15, 2026
…h copy/paste instructions and suspicious domains (French/Français)
IndiaAce
approved these changes
Apr 16, 2026
Member
IndiaAce
left a comment
IndiaAce
left a comment
There was a problem hiding this comment.
Approved with non-blocking feedback.
github-actions bot
added a commit
that referenced
this pull request
Apr 16, 2026
…h copy/paste instructions and suspicious domains (French/Français)
github-actions bot
added a commit
that referenced
this pull request
Apr 16, 2026
…structions and suspicious domains (French/Français)
D-Bolton
deleted the
daniel.fn.ESC-9460.has-sent-you-a-protected-message
branch
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
Detects messages where the sender emails themselves with both their email address and display name present in the subject line, while the email address differs from the display name.
Associated samples
Associated hunts