Detection rules › Sublime MQL
Link: Abused Adobe Express
The detection rule matches on message groups which make use of Adobe Express as a landing page. The landing page contains links which are newly registered, use free file or subdomain hosts, url shortners or when visited are phishing pages, lead to a captcha or rediret to a top website.
Threat classification
Sublime's own taxonomy (not MITRE ATT&CK).
| Category | Values |
|---|---|
| Attack types | Credential Phishing |
| Tactics and techniques | Evasion, Free subdomain host, Free file host |
Event coverage
| Message attribute |
|---|
| body |
| body.links (collection) |
| type |
Rule body MQL
type.inbound
and any(filter(body.links,
// the link is a new.express.adobe.com page
.href_url.domain.domain == "new.express.adobe.com"
and strings.starts_with(.href_url.path, "/webpage/")
),
// filter down the links on express.adobe.com page to those that are external to adobe
// check that the length of external links is reasonable
length(distinct(filter(ml.link_analysis(., mode="aggressive").final_dom.links,
// filter any links on the adobe express page which are
// on express.adobe.com
.href_url.domain.domain != 'new.express.adobe.com'
// or www.adobe.com (privacy page/report abuse/etc)
and .href_url.domain.domain != 'www.adobe.com'
// relative links (no domains)
and .href_url.domain.domain is not null
),
.href_url.domain.domain
)
) <= 10
and any(filter(ml.link_analysis(., mode="aggressive").final_dom.links,
// filter any links on the adobe express page which are
// on express.adobe.com
.href_url.domain.domain != 'new.express.adobe.com'
// or www.adobe.com (privacy page/report abuse/etc)
and .href_url.domain.domain != 'www.adobe.com'
// relative links (no domains)
and .href_url.domain.domain is not null
),
(
// any of those links domains are new
network.whois(.href_url.domain).days_old < 30
// go to free file hosts
or .href_url.domain.root_domain in $free_file_hosts
or .href_url.domain.domain in $free_file_hosts
// go to free subdomains hosts
or (
.href_url.domain.root_domain in $free_subdomain_hosts
// where there is a subdomain
and .href_url.domain.subdomain is not null
and .href_url.domain.subdomain != "www"
)
// go to url shortners
or .href_url.domain.root_domain in $url_shorteners
or .href_url.domain.root_domain in $social_landing_hosts
or .href_url.domain.domain in $url_shorteners
or .href_url.domain.domain in $social_landing_hosts
or (
// find any links that mention common "action" words
regex.icontains(.display_text,
'(?:view|click|show|access|download|goto|Validate|Va[il]idar|login|verify|account)'
)
and (
// and when visiting those links, are phishing
ml.link_analysis(., mode="aggressive").credphish.disposition == "phishing"
// hit a captcha page
or ml.link_analysis(., mode="aggressive").credphish.contains_captcha
// or the page redirects to common website, observed when evasion happens
or (
length(ml.link_analysis(., mode="aggressive").redirect_history
) > 0
and ml.link_analysis(., mode="aggressive").effective_url.domain.root_domain in $tranco_10k
)
)
)
)
)
)
and profile.by_sender().prevalence != "common"
Detection logic
Scope: inbound message.
The detection rule matches on message groups which make use of Adobe Express as a landing page. The landing page contains links which are newly registered, use free file or subdomain hosts, url shortners or when visited are phishing pages, lead to a captcha or rediret to a top website.
- inbound message
any of
filter(body.links)where all hold:- length(distinct(filter(ml.link_analysis(., mode='aggressive').final_dom.links, .href_url.domain.domain != 'new.express.adobe.com' and .href_url.domain.domain != 'www.adobe.com' and .href_url.domain.domain is not null), .href_url.domain.domain)) ≤ 10
any of
filter(...)where any holds:- network.whois(.href_url.domain).days_old < 30
- .href_url.domain.root_domain in $free_file_hosts
- .href_url.domain.domain in $free_file_hosts
all of:
- .href_url.domain.root_domain in $free_subdomain_hosts
- .href_url.domain.subdomain is set
- .href_url.domain.subdomain is not 'www'
- .href_url.domain.root_domain in $url_shorteners
- .href_url.domain.root_domain in $social_landing_hosts
- .href_url.domain.domain in $url_shorteners
- .href_url.domain.domain in $social_landing_hosts
all of:
- .display_text matches '(?:view|click|show|access|download|goto|Validate|Va[il]idar|login|verify|account)'
any of:
- ml.link_analysis(.).credphish.disposition is 'phishing'
- ml.link_analysis(.).credphish.contains_captcha
all of:
- length(ml.link_analysis(., mode='aggressive').redirect_history) > 0
- ml.link_analysis(.).effective_url.domain.root_domain in $tranco_10k
- profile.by_sender().prevalence is not 'common'
Inspects: body.links, body.links[].href_url.domain.domain, body.links[].href_url.path, type.inbound. Sensors: ml.link_analysis, network.whois, profile.by_sender, regex.icontains, strings.starts_with. Reference lists: $free_file_hosts, $free_subdomain_hosts, $social_landing_hosts, $tranco_10k, $url_shorteners.
Indicators matched (3)
| Field | Match | Value |
|---|---|---|
body.links[].href_url.domain.domain | equals | new.express.adobe.com |
strings.starts_with | prefix | /webpage/ |
regex.icontains | regex | (?:view|click|show|access|download|goto|Validate|Va[il]idar|login|verify|account) |