Detects unauthorized Messenger access attempts based on the Messenger Service pattern group.
| matchsig field=domain guid="4325a8d6-49d1-4f68-803b-dfef9527fe50" verify=f
| eval result = strjoin("\n", foreach(valueof(_1, "rule"), _matchsig_result)) | fields - _matchsig_result
