FP Tune: Update impersonation_microsoft.yml (#789)

sublime-security · Sep 13, 2023 · dec1558 · dec1558
1 parent d970f36
commit dec1558
Showing 1 changed file with 8 additions and 2 deletions.
diff --git a/detection-rules/impersonation_microsoft.yml b/detection-rules/impersonation_microsoft.yml
@@ -36,8 +36,13 @@ source: |
       'Microsoft Azure'
     )
   )
-  and sender.email.domain.root_domain not in~ ('microsoft.com', 'microsoftsupport.com', 'office.com')
-
+  and sender.email.domain.root_domain not in~ (
+    'microsoft.com',
+    'microsoftsupport.com',
+    'office.com',
+    'teams-events.com'
+  )
+  
   // first-time sender
   and (
     (
@@ -49,6 +54,7 @@ source: |
       and sender.email.domain.domain not in $sender_domains
     )
   )
+
 attack_types:
   - "Credential Phishing"
 tactics_and_techniques: