Update: recon_short_generic_greeting.yml - Adding compound logic

[missingn0pe]

Description

Extends the existing short greeting recon detection to catch display name-based reconnaissance patterns. Detects messages where the sender's display name (or portions of it) appear in the subject line, or where the subject contains only a full name pattern (i.e, "Regina Wallace-Jones") that doesn't match the sender or recipient.

Impact: 130 net new detections (without negations)

Changes

Subject Length Extension

• Extended subject limit from 15 → 20 characters when display name match is detected
• Maintains original 15-char limit for standard short greetings

Display Name Extraction

• Uses regex.extract(sender.display_name, '[A-Za-z]{4,}') to extract 4+ letter words from sender display name
• Checks if any extracted word appears in subject (e.g., "JAMES" from "JAMES WILLIAM" matches "Hi This is James")

Full Name Pattern Matching

• Detects subjects that are ONLY "FirstName LastName" or "FirstName Hyphenated-LastName"
• Regex: ^[A-Z][a-z]+ [A-Z][a-z]+(-[A-Z][a-z]+)?$
• Excludes matches when subject equals sender or recipient display names (FP reduction)

Logic submitted: Without negations

Alternative considered: With negations (91 net new detections)

and not strings.icontains(subject.base,
                          "subscription",
                          "customer",
                          "invite",
                          "support",
                          "insurance"
)

Rationale: We could choose either route. "With negations" has less noise, but these also have little to no context and "could be considered" recon. However, it's likely this is just human error.

WITH negations hunt links (alternative):

• Comparative (Shared samples) - L90D
• PR Logic (Shared samples) - L90D
• Comparative (Multi-hunt) - L90D
• PR Logic (Multi-hunt) - L90D

Additional Finding:
It's worth noting, I've discovered a new style of VIP Impersonation, and it is hit or miss on VIP rule matching. I will look into these post runner.

Associated samples

• Sample 1 - Hi This is James
• Sample 2 - Regina Wallace-Jones

Associated hunts

• Comparative (Shared samples) - L90D
• PR Logic (Shared samples) - L90D
• Comparative (Multi-hunt) - L90D
• PR Logic (Multi-hunt) - L90D