Update link_sharepoint_attached_eml.yml

detection-rules/link_sharepoint_attached_eml.yml

@@ -105,6 +105,12 @@ source: |
               and all(recipients.to,
                       .email.email == file.parse_eml(..).sender.email.email
               )
+            ),
+            
+            // the attached message contains a very low number of hops, as if it was never sent
+            (
+              length(file.parse_eml(.).headers.hops) <= 2
+              or file.parse_eml(.).headers.return_path.email is null
             )
           )
   )