[Test Rules] [PR #4375] modified rule: Brand impersonation: Microsoft Teams

Author: github-actions[bot]

detection-rules/4375_impersonation_microsoft_teams.yml

@@ -29,7 +29,10 @@ source: |
     sender.email.domain.root_domain in (
       "microsoft.com",
       "microsoftsupport.com",
-      "office.com"
+      "office.com",
+      "mail.microsoft",
+      "service-now.com",
+      "atlassian.net"
     )
     and coalesce(headers.auth_summary.dmarc.pass, false)
   )
@@ -47,4 +50,4 @@ detection_methods:
 id: "7fafff75-abd3-5b8c-879f-b26b269ad768"
 og_id: "9cd53055-8e1a-5a45-b78f-34a62f0793dd"
 testing_pr: 4375
-testing_sha: 2e095c73e2fc1a71f6fc33b4553612cf09762755
+testing_sha: 3f03b2f62212d70d00dc818636e1976ebe79e2d3