diff --git a/detection-rules/impersonation_chase.yml b/detection-rules/impersonation_chase.yml index 420d9b5051e..ba22843d581 100644 --- a/detection-rules/impersonation_chase.yml +++ b/detection-rules/impersonation_chase.yml @@ -14,7 +14,8 @@ source: | '*chase sapphire*', '*chase card services*', '*united mileageplus*', - "echase*" + "echase*", + "*freedom unlimited*" ) or strings.ilevenshtein(sender.display_name, 'chase sapphire') <= 2 or strings.ilevenshtein(sender.display_name, 'chase card services') <= 2