Skip to content

Create fake discount promotion rule #4645

Open
cybher0808 wants to merge 5 commits into
mainfrom
cybher0808.fn.esc-15262.fakepromotion
Open

Create fake discount promotion rule #4645
cybher0808 wants to merge 5 commits into
mainfrom
cybher0808.fn.esc-15262.fakepromotion

Conversation

@cybher0808

@cybher0808 cybher0808 commented Jun 9, 2026

Copy link
Copy Markdown
Member

Description

Detects messages containing fake product discount offers with Claim X% Off button that links to googleapis.com domain.

Associated samples

Associated hunts

@cybher0808 cybher0808 requested a review from a team June 9, 2026 20:35
@cybher0808 cybher0808 requested a review from a team as a code owner June 9, 2026 20:35
@cybher0808 cybher0808 self-assigned this Jun 9, 2026
github-actions Bot added a commit that referenced this pull request Jun 9, 2026
…gle APIs for fake product discount promotion
@cybher0808 cybher0808 added the in-test-rules PR is in our testing suite to collect telemetry label Jun 9, 2026
github-actions Bot added a commit that referenced this pull request Jun 9, 2026
github-actions Bot added a commit that referenced this pull request Jun 11, 2026
github-actions Bot added a commit that referenced this pull request Jun 11, 2026
…Google APIs for fake product discount promotion
github-actions Bot added a commit that referenced this pull request Jun 12, 2026
github-actions Bot added a commit that referenced this pull request Jun 12, 2026
@cybher0808 cybher0808 added the review-needed Indicates that a PR is waiting for review label Jun 12, 2026
@cybher0808

Copy link
Copy Markdown
Member Author

Marking for R4R here since after reviewing latest results from hunt.

@IndiaAce IndiaAce left a comment

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Two nits/thoughts, otherwise results look great, nice find! Gonna remove the review-needed filter for the time being feel free to add it back whenever!

Comment thread detection-rules/fake_discount_promotion.yml
Comment thread detection-rules/fake_discount_promotion.yml
@IndiaAce IndiaAce removed the review-needed Indicates that a PR is waiting for review label Jun 12, 2026
@IndiaAce IndiaAce self-assigned this Jun 12, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

in-test-rules PR is in our testing suite to collect telemetry

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants