[PR #3371] modified rule: Credential phishing: Suspicious Nifty.com sender address

github-actions[bot] · github-actions[bot] · commit f2a7de2292e2 · 2025-11-05T07:47:15.000Z
diff --git a/detection-rules/3371_credential_phishing_nifty.com_domain_abuse.yml b/detection-rules/3371_credential_phishing_nifty.com_domain_abuse.yml
@@ -1,4 +1,4 @@
-name: "Credential phishing: Nifty.com platform abuse"
+name: "Credential phishing: Suspicious Nifty.com sender address"
 description: "Detects emails from nifty.com where the sender's local part matches a recipient's local part or organizational SLD, which has been observed in credential harvesting campaigns"
 type: "rule"
 severity: "medium"
@@ -29,4 +29,4 @@ detection_methods:
 id: "2feb95a2-78f4-569b-8d33-659ac7b17e3f"
 og_id: "370cfdac-4976-59a1-ae1f-7cd5594eb958"
 testing_pr: 3371
-testing_sha: c80a4a02dcffe7056f91513374fa805d1ad01a17
+testing_sha: bce1db4513a6dfe62e98e01ab8c5980c606fc837
