[Shared Samples] [PR #4642] modified rule: PR# 4642 - Evasion: Hidden content divs from Gmail sender

Author: github-actions[bot]

detection-rules/4642_evasion_hidden_content_gmail.yml

@@ -4,7 +4,7 @@ type: "rule"
 severity: "medium"
 source: |
   type.inbound
-  and sender.email.domain.domain == 'gmail.com'
+  and sender.email.domain.root_domain in $free_email_providers
   and strings.count(body.html.raw,
                     '<div style="display:none;opacity:0;width:0;height:0;overflow:hidden" aria-hidden="true">'
   ) >= 3