[Shared Samples] [PR #4375] modified rule: PR# 4375 - Brand impersonation: Microsoft Teams

github-actions[bot] · github-actions[bot] · commit 12d007481d35 · 2026-04-22T13:50:58.000Z
diff --git a/detection-rules/4375_impersonation_microsoft_teams.yml b/detection-rules/4375_impersonation_microsoft_teams.yml
@@ -29,7 +29,10 @@ source: |
     sender.email.domain.root_domain in (
       "microsoft.com",
       "microsoftsupport.com",
-      "office.com"
+      "office.com",
+      "mail.microsoft",
+      "service-now.com",
+      "atlassian.net"
     )
     and coalesce(headers.auth_summary.dmarc.pass, false)
   )

Original file line number	Diff line number	Diff line change
`@@ -29,7 +29,10 @@ source: \|`
`29`	`29`	`sender.email.domain.root_domain in (`
`30`	`30`	`"microsoft.com",`
`31`	`31`	`"microsoftsupport.com",`
`32`		`- "office.com"`
	`32`	`+ "office.com",`
	`33`	`+ "mail.microsoft",`
	`34`	`+ "service-now.com",`
	`35`	`+ "atlassian.net"`
`33`	`36`	`)`
`34`	`37`	`and coalesce(headers.auth_summary.dmarc.pass, false)`
`35`	`38`	`)`