From 1e88f4c00ec5d904ae8b654dfbeeafd14992887d Mon Sep 17 00:00:00 2001
From: Aiden Mitchell <me@aidenmitchell.ca>
Date: Tue, 17 Oct 2023 12:17:28 -0700
Subject: [PATCH] Update link_microsoft_low_reputation.yml (#858)

Co-authored-by: Sam Scholten <sam@sublimesecurity.com>
---
 detection-rules/link_microsoft_low_reputation.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/detection-rules/link_microsoft_low_reputation.yml b/detection-rules/link_microsoft_low_reputation.yml
index eb4fec631e1..104b8c3d75a 100644
--- a/detection-rules/link_microsoft_low_reputation.yml
+++ b/detection-rules/link_microsoft_low_reputation.yml
@@ -61,7 +61,7 @@ source: |
                    "*fax*",
                    "*storage*",
                    "*quota*",
-                   "*messages*"
+                   "*message*"
      )
      and strings.ilike(body.plain.raw,
                        "*terminated*",