From a9cb5da0cf0ed3091b0005f9073e3129b2c44caa Mon Sep 17 00:00:00 2001 From: John Farina Date: Tue, 8 Sep 2026 16:31:04 -0400 Subject: [PATCH] Update impersonation_microsoft.yml --- detection-rules/impersonation_microsoft.yml | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/detection-rules/impersonation_microsoft.yml b/detection-rules/impersonation_microsoft.yml index 83a7e391ec7..22a8c87a02d 100644 --- a/detection-rules/impersonation_microsoft.yml +++ b/detection-rules/impersonation_microsoft.yml @@ -58,7 +58,10 @@ source: | and beta.parse_exif(.).page_count == 1 and any(ml.logo_detect(.).brands, .name == "Microsoft") and any(file.explode(.), - regex.icontains(.scan.ocr.raw, '[©@]\s*(?:\d+)?\s*Microsoft') + regex.icontains(.scan.ocr.raw, + '[©@]\s*(?:\d+)?\s*Microsoft', + 'message key-\d' + ) ) ) )