Update impersonation_dropbox.yml (#2109)

Co-authored-by: Sam Scholten <[email protected]>

detection-rules/impersonation_dropbox.yml

@@ -15,7 +15,7 @@ source: |
            and not .href_url.domain.root_domain in ("mimecast.com", "mimecastprotect.com")
     )
   )
-  and sender.email.domain.root_domain !~ 'dropbox.com'
+  and sender.email.domain.root_domain not in~ ('dropbox.com', 'dropboxforum.com')
   and (
     any(attachments,
         .file_type in $file_types_images