Update credential_phishing_corporate_services_impersonation.yml (#2390)

detection-rules/credential_phishing_corporate_services_impersonation_with_suspicious_link.yml

@@ -36,13 +36,20 @@ source: |
                               "HR (new|vue|view|tech admin|global)"
       )
     )
-    
+  
     // or assessment report language found in body
     or (
-        regex.icontains(body.current_thread.text, '20\d{2}(?:[[:punct:]](?:20)?\d{2})? (?:\w+ )?assessment report')
+      regex.icontains(body.current_thread.text,
+                      '20\d{2}(?:[[:punct:]](?:20)?\d{2})? (?:\w+ )?assessment report'
+      )
+    )
+  
+    // or HR department language found in body via NLU
+    or any(ml.nlu_classifier(body.current_thread.text).entities,
+           .name == "org" and regex.icontains(.text, '\bhr\b', 'human resources')
     )
   )
-    
+  
   // suspicious display_text
   and (
     any(body.links,