Signed-off-by: Ryan B <randomrhythm@rhythmengineering.com>

rule to attempt to find webmailers sent from compromised hosts.

Email_fake_it_maintenance_bulletin
Email_generic_phishing.yar
Email_quota_limit_warning.yar

Signed-off-by: Ryan B <randomrhythm@rhythmengineering.com>

<class 'yara.SyntaxError'>: unreferenced string "$

changed condition to correct string

Generic rule to identify phishing emails

Rule to prevent against known phishing campaign targeting American companies using Microsoft Exchange.

Added $eml strings and condition. Set condition value higher for $body, requiring more string matches to avoid FP.

YARA Rule for known phishing campaign affecting multiple American companies.