Sync from PR#2210

Create infra_abuse_hardbacon.yml by @aidenmitchell
#2210
Source SHA 66eff76
Triggered by @aidenmitchell

detection-rules/infra_abuse_hardbacon.yml

@@ -0,0 +1,21 @@
+name: "Hardbacon infrastructure abuse"
+description: "Hardbacon is a defunct Canadian budgeting app. Attackers have been observed using their marketing platform to send credential phishing messages."
+type: "rule"
+severity: "high"
+source: |
+  type.inbound
+  and sender.email.domain.root_domain in ('hardbacon.com', 'hardbacon.ca')
+  and headers.auth_summary.dmarc.pass
+  and headers.auth_summary.spf.pass
+attack_types:
+  - "Credential Phishing"
+tactics_and_techniques:
+  - "Evasion"
+  - "Impersonation: Brand"
+  - "Social engineering"
+detection_methods:
+  - "Header analysis"
+  - "Sender analysis"
+id: "5330db42-10d2-5671-bcb2-a99449ac24c2"
+testing_pr: 2210
+testing_sha: 66eff76a518f360508bc71b32ccf9d9c82978108