From 520c9bec27cd38d19526afebd185c3508ae6770f Mon Sep 17 00:00:00 2001 From: Brandon Murphy <4827852+zoomequipd@users.noreply.github.com> Date: Wed, 13 Nov 2024 15:58:22 -0600 Subject: [PATCH] Update impersonation_dropbox.yml (#2109) Co-authored-by: Sam Scholten --- detection-rules/impersonation_dropbox.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/detection-rules/impersonation_dropbox.yml b/detection-rules/impersonation_dropbox.yml index da19ed5e0c5..764eb8b2d7e 100644 --- a/detection-rules/impersonation_dropbox.yml +++ b/detection-rules/impersonation_dropbox.yml @@ -15,7 +15,7 @@ source: | and not .href_url.domain.root_domain in ("mimecast.com", "mimecastprotect.com") ) ) - and sender.email.domain.root_domain !~ 'dropbox.com' + and sender.email.domain.root_domain not in~ ('dropbox.com', 'dropboxforum.com') and ( any(attachments, .file_type in $file_types_images