[PR #3050] modified rule: Brand Impersonation: Salesforce

Author: github-actions[bot]

detection-rules/3050_brand_impersonation_salesforce.yml

@@ -20,7 +20,8 @@ source: |
           "tangocard.com", // https://www.tangocard.com/salesforce-partnership
           "elevatesalesforce.com", // unrelated but name in domain 
           "salesforceben.com", // salesforce newsletter
-          "connectwithsal.com" // levenshtein 
+          "connectwithsal.com", // levenshtein 
+          "smartsheet.com" // used by salesforce
         )
         or sender.email.domain.domain in ("salesforce.rxsavingssolutions.com") // unrelated but legit domain 
       )
@@ -64,4 +65,4 @@ detection_methods:
 id: "c5f0e666-81f0-5d17-a470-12ab75113631"
 og_id: "736dfb87-1f99-5cdb-aefc-392257376f3d"
 testing_pr: 3050
-testing_sha: 4ab18f108393f5bc666bcede56c727bfe331192c
+testing_sha: ac8c7a84e5ee302772c0619c2a69201a99b15ad2