Update impersonation_docusign.yml

detection-rules/impersonation_docusign.yml

@@ -337,7 +337,7 @@ source: |
                  or strings.icontains(.display_text, "Review on Docusign")
                  or (
                    strings.icontains(.display_text, "Sign")
-                   and strings.icontains(.display_text, "Now")
+                   and regex.icontains(.display_text, '(?:in\b|now)')
                  )
                )
         ),