Update credential_phishing_esign_document_notification.yml (#3496)

Author: IndiaAce

detection-rules/credential_phishing_esign_document_notification.yml

@@ -243,15 +243,22 @@ source: |
       )
     )
   )
+  // the message is unsolicited and no false positives
   and (
     not profile.by_sender_email().solicited
     or profile.by_sender_email().prevalence == "new"
     or (
       profile.by_sender_email().any_messages_malicious_or_spam
       and not profile.by_sender_email().any_messages_benign
     )
+    or (
+      profile.by_sender_email().any_messages_malicious_or_spam
+      and profile.by_sender_email().any_messages_benign
+      and (
+        not headers.auth_summary.dmarc.pass or not headers.auth_summary.spf.pass
+      )
+    )
   )
-  and not profile.by_sender_email().any_messages_benign
   
   // negate replies/fowards containing legitimate docs
   and not (