Update observed IOC rules - 2026-06-01

detection-rules/observed_malicious_sender_emails.yml

@@ -8,15 +8,12 @@ source: |
   type.inbound
   and hash.sha256(sender.email.email) in (
     '181190a9c44fffd9796cfcdea3efc48951283093cd4f0659655b7164f56bddfd', // Observed malicious sender
-    '284bc29a19d2f97642e3e69e0b5f6bac0d425b6a25827b9947aec4fb5faac812', // Observed malicious sender
     '384a79a76bf04331e0a6d8cb2056b6b56b05fb27b4abf87cc648e610cab3ae27', // Observed malicious sender
     '45df5110a927dc6160ee706784b4b3f75bc3f9154c75b3c28a524501a25943f5', // Observed malicious sender
     '4d3b689898ba624f2032a9e928e258b3650f0ffd5c898f49f9816e1c6e09b575', // Observed malicious sender
     '4ee49251788e4434160029e76e7c168432a1d5df45177b8c113a60562b2f4743', // Observed malicious sender
     '596544745fbc6b8bab69197761c945c13799b9ac2ffac93b4a69fc9b335870d0', // Observed malicious sender
-    '77eb1e845faaef33b55023bf10fa643206e8620c49d5d1f4eba9d7d5882093f0', // Observed malciiouc sender, AFF and fake zoom meetings
     '7affbe4b711761fcbeea34fafe0df6d217463064e60510e12af92b57dbfbf186', // Observed malicious sender
-    '8d6bf7faaf7190b52d0e7a079cd71228e2d1a20a6fac7749b23226181fe57b7f', // Observed malicious sender
     'd3193407cf75baf52783c7bfc1929e7c968cd71d113c12cba0b4b31e68dce8ff', // Observed malicious sender
     'eaa6ae148c389d5ffc77ca5437cc24e1ecca7052be3313c1e752de67d161f7c2' // Observed malicious sender
   )

detection-rules/observed_malicious_sender_root_domains.yml

@@ -7,7 +7,6 @@ source: |
   // Managed by automated IOC system
   type.inbound
   and hash.sha256(sender.email.domain.root_domain) in (
-    '67108effe3f74404f4b4a52a7dc91aeb228613c751a8750d48f3bb44dae9d65c', // Observed malicious sender domain
     'cb9a978a274a3517107b67deeaac47987110feb4d398097339965a064ecbfa7a' // Reported from a customer
   )