Update impersonation_human_resources.yml (#859)

Co-authored-by: Sam Scholten <[email protected]>

detection-rules/impersonation_human_resources.yml

@@ -15,7 +15,7 @@ source: |
   and any(ml.nlu_classifier(body.current_thread.text).entities, .name == "urgency")
   and (
     any(ml.nlu_classifier(body.current_thread.text).intents, .name != "benign")
-    and not length(ml.nlu_classifier(body.current_thread.text).intents) == 0
+    or length(ml.nlu_classifier(body.current_thread.text).intents) == 0  // not benign but not malicious either
   )
   and (
     profile.by_sender().prevalence in ("new", "outlier")