Detection rules › Sublime MQL
Service abuse: Behance document sharing with suspicious language
Detects messages containing document sharing language with a single Behance gallery link, potentially indicating abuse of the legitimate Adobe Behance platform for malicious purposes.
Threat classification
Sublime's own taxonomy (not MITRE ATT&CK).
| Category | Values |
|---|---|
| Attack types | Credential Phishing |
| Tactics and techniques | Free file host, Social engineering |
Event coverage
| Message attribute |
|---|
| body.current_thread |
| headers.auth_summary |
| sender.email |
| type |
Rule body MQL
type.inbound
and length(body.current_thread.text) < 10000
and strings.ilike(body.current_thread.text,
"*proposal*",
"*specified link*",
"*secure*"
)
and length(filter(body.current_thread.links,
.href_url.domain.root_domain == 'behance.net'
and strings.icontains(.href_url.path, '/gallery/')
and .display_url.domain.root_domain == 'behance.net'
and strings.icontains(.display_url.path, '/gallery/')
)
) == 1
and not (
sender.email.domain.root_domain in $high_trust_sender_root_domains
and coalesce(headers.auth_summary.dmarc.pass, false)
)
Detection logic
Scope: inbound message.
Detects messages containing document sharing language with a single Behance gallery link, potentially indicating abuse of the legitimate Adobe Behance platform for malicious purposes.
- inbound message
- length(body.current_thread.text) < 10000
body.current_thread.text matches any of 3 patterns
*proposal**specified link**secure*
- length(filter(body.current_thread.links, .href_url.domain.root_domain == 'behance.net' and strings.icontains(.href_url.path, '/gallery/') and .display_url.domain.root_domain == 'behance.net' and strings.icontains(.display_url.path, '/gallery/'))) is 1
not:
all of:
- sender.email.domain.root_domain in $high_trust_sender_root_domains
- coalesce(headers.auth_summary.dmarc.pass)
Inspects: body.current_thread.links, body.current_thread.links[].display_url.domain.root_domain, body.current_thread.links[].display_url.path, body.current_thread.links[].href_url.domain.root_domain, body.current_thread.links[].href_url.path, body.current_thread.text, headers.auth_summary.dmarc.pass, sender.email.domain.root_domain, type.inbound. Sensors: strings.icontains, strings.ilike. Reference lists: $high_trust_sender_root_domains.
Indicators matched (6)
| Field | Match | Value |
|---|---|---|
strings.ilike | substring | *proposal* |
strings.ilike | substring | *specified link* |
strings.ilike | substring | *secure* |
body.current_thread.links[].href_url.domain.root_domain | equals | behance.net |
strings.icontains | substring | /gallery/ |
body.current_thread.links[].display_url.domain.root_domain | equals | behance.net |