Update description

Author: D-Bolton

detection-rules/attachment_credential_phishing_image_as_content.yml

@@ -1,7 +1,7 @@
 name: "Credential phishing: Image as content, short or no body contents"
 description: |
   This rule identifies incoming messages with minimal links, all image attachments and either empty, brief
-  or the body text is only a warning banner/disclaimer. It also checks for truncated PNG images or logos in addition
+  or the body text is only a warning banner/disclaimer. It also checks for truncated PNG images, logos, or domain references in addition
   to high-confidence credit theft intentions.
 type: "rule"
 severity: "medium"