Add detection rule for MSG files with VBA macros

[peterdj45]

Description

This rule detects MSG file attachments that contain VBA macros with medium to high risk indicators, which can be used to deliver malicious code.

Associated samples

• https://platform.sublime.security/messages/4ff803d62e26e2b7f6360fed05001ecca53b57d40f1b042b1d1d6e9d56dc710a?preview_id=019be798-3153-757f-b348-e00b905483d4

Associated hunts

• https://platform.sublime.security/messages/hunt?huntId=019c093e-d5c2-70cb-b8af-38b68ce39d52

[peterdj45]

hasn't fired in test rules yet. changing to ASR

[IndiaAce]

Hello! Just some thoughts here while reviewing. Since this only matched 1 email, the scope might be a little too tight. There's an opportunity here to use this rule and modify it to account for this file_type/extension I ran a hunt for this proposed logic... not necessarily saying this is 100% the fix but it might be a starting point here. Happy to hear your case if you want this to be a separate rule, but I'm going to remove the review-needed tab for the time being. LMK your thoughts.