Update detection name

Author: 0xC0FFEEEE

detections/cloud/o365_suspicious_mailbox_rule_created.yml renamed to detections/cloud/o365_bec_email_hiding_rule_created.yml

@@ -1,11 +1,11 @@
-name: O365 Suspicious Mailbox Rule Created
+name: O365 BEC Email Hiding Rule Created
 id: 603ebac2-f157-4df7-a6ac-34e8d0350f86
 version: 1
 date: '2025-02-14'
 author: '0xC0FFEEEE, Github Community'
 type: TTP
 status: production
-description: This analytic detects suspicious mailbox rule creation, a common technique used in Business Email Compromise. It uses a scoring mechanism to identify a combination of attributes often featured in mailbox rules created by attackers.
+description: This analytic detects mailbox rule creation, a common technique used in Business Email Compromise. It uses a scoring mechanism to identify a combination of attributes often featured in mailbox rules created by attackers.
   This may indicate that an attacker has gained access to the account.
 search: '`o365_management_activity` Workload=Exchange Operation="New-InboxRule" | rename Parameters{}.*
   as * | eval temp=mvzip(Name,Value, "<JOIN>") | fields - Name Value | mvexpand temp
@@ -15,7 +15,7 @@ search: '`o365_management_activity` Workload=Exchange Operation="New-InboxRule"
   | eval entropy_score=if(ut_shannon<=2, 1, 0) | eval len_score=if(len(Name)<=3, 1,
   0) | eval read_score=if(MarkAsRead="True", 1, 0) | eval folder_score=if(match(MoveToFolder,
   "^(RSS|Conversation History|Archive)"), 1, 0) | eval suspicious_score=entropy_score+len_score+read_score+folder_score
-  | where suspicious_score>2 | `o365_suspicious_mailbox_rule_created_filter`'
+  | where suspicious_score>2 | `o365_bec_email_hiding_rule_created_filter`'
 how_to_implement: You must install the Splunk Microsoft Office 365 Add-on and ingest
   Office 365 management activity events. You also need to have the Splunk TA URL 
   Toolbox (https://splunkbase.splunk.com/app/2734/) installed.
@@ -33,7 +33,7 @@ drilldown_searches:
   earliest_offset: $info_min_time$
   latest_offset: $info_max_time$
 rba:
-  message: A suspicious mailbox rule was created by $user$
+  message: Potential BEC mailbox rule was created by $user$
   risk_objects:
   - field: user
     type: user