Sync from PR#932

TEST - Update headers_russia_return_path.yml by @morriscode
#932
Source SHA 779a368
Triggered by @morriscode

detection-rules/headers_russia_return_path.yml

@@ -0,0 +1,19 @@
+name: "Russia return-path TLD (first-time sender)"
+description: |
+  The return-path header is a .ru TLD and first-time sender.
+type: "rule"
+severity: "low"
+source: |
+  type.inbound
+  and headers.return_path.domain.tld == "ru"
+  and sender.email.email not in $recipient_emails
+attack_types:
+  - "BEC/Fraud"
+  - "Credential Phishing"
+  - "Malware/Ransomware"
+detection_methods:
+  - "Header analysis"
+  - "Sender analysis"
+id: "588b3954-c03a-57fb-b5a4-abf993a8c003"
+testing_pr: 932
+testing_sha: 779a368e54da93bb7625d163243f2d5d0c100308