[PR #3050] modified rule: Brand Impersonation: Salesforce

Author: github-actions[bot]

detection-rules/3050_brand_impersonation_salesforce.yml

@@ -27,7 +27,8 @@ source: |
           "kestoneglobal.biz", // third party 
           "salesforceeurope.com", // outsourced salesforce staffing
           "salesforcerecruiter.com", // outsourced salesforce staffing
-          "on24event.com"
+          "on24event.com", // events for salesforce
+          "cypress.courses" // trainign for salesforce
         )
         or sender.email.domain.domain in ("salesforce.rxsavingssolutions.com", "salesforce.jointcommission.org") // unrelated but legit domains
       )
@@ -71,4 +72,4 @@ detection_methods:
 id: "c5f0e666-81f0-5d17-a470-12ab75113631"
 og_id: "736dfb87-1f99-5cdb-aefc-392257376f3d"
 testing_pr: 3050
-testing_sha: 73d04b06fccfa51b736c3d359077d6b787e642b1
+testing_sha: e316d802023acab08a4ea93eb6e4f064fa9e5220