From 3dc50db8de75dde855dcc115e12bef21a86539a7 Mon Sep 17 00:00:00 2001 From: John Farina Date: Wed, 9 Sep 2026 10:43:29 -0400 Subject: [PATCH 1/2] Update impersonation_sam_sba_federal_registration.yml --- detection-rules/impersonation_sam_sba_federal_registration.yml | 1 + 1 file changed, 1 insertion(+) diff --git a/detection-rules/impersonation_sam_sba_federal_registration.yml b/detection-rules/impersonation_sam_sba_federal_registration.yml index f538f34ec22..50903eda437 100644 --- a/detection-rules/impersonation_sam_sba_federal_registration.yml +++ b/detection-rules/impersonation_sam_sba_federal_registration.yml @@ -12,6 +12,7 @@ source: | '^sba[\s-](?:connect|invoice|admin|eidl|profile)\b', '^sba[\s-]support[\s-]\w+' ) + or strings.icontains(sender.email.domain.root_domain, "samrenewal") or ( strings.icontains(body.current_thread.text, 'sam.gov') and any(html.xpath(body.html, '//img/@src').nodes, From 41fd1dbb461527572fde39b86614b7d7facb7db5 Mon Sep 17 00:00:00 2001 From: John Farina Date: Wed, 9 Sep 2026 13:46:07 -0400 Subject: [PATCH 2/2] Update impersonation_sam_sba_federal_registration.yml --- ...ersonation_sam_sba_federal_registration.yml | 18 +++++++++++++----- 1 file changed, 13 insertions(+), 5 deletions(-) diff --git a/detection-rules/impersonation_sam_sba_federal_registration.yml b/detection-rules/impersonation_sam_sba_federal_registration.yml index 50903eda437..ad602b7def7 100644 --- a/detection-rules/impersonation_sam_sba_federal_registration.yml +++ b/detection-rules/impersonation_sam_sba_federal_registration.yml @@ -12,12 +12,20 @@ source: | '^sba[\s-](?:connect|invoice|admin|eidl|profile)\b', '^sba[\s-]support[\s-]\w+' ) - or strings.icontains(sender.email.domain.root_domain, "samrenewal") or ( - strings.icontains(body.current_thread.text, 'sam.gov') - and any(html.xpath(body.html, '//img/@src').nodes, - strings.icontains(.raw, 'sam%20renew%20entity') - or regex.icontains(.raw, '[./]sam[a-z]{3,}\.com') + strings.icontains(body.current_thread.text, + 'sam.gov', + 'system for award management' + ) + and ( + any(html.xpath(body.html, '//img/@src').nodes, + strings.icontains(.raw, 'sam%20renew%20entity') + or regex.icontains(.raw, '[./]sam[a-z]{3,}\.com') + ) + or regex.icontains(subject.base, + 'cage\s+code\s+[a-z0-9]{5}', + 'sam\s(?:renew|status)' + ) ) ) )