Detection rules › Sublime MQL
Service abuse: Adobe Creative Cloud share from an unsolicited sender address
Detects messages from Adobe Creative Cloud in which the document originates from a newly observed email address. The email address is extracted from the HTML body.
Threat classification
Sublime's own taxonomy (not MITRE ATT&CK).
| Category | Values |
|---|---|
| Attack types | Credential Phishing |
| Tactics and techniques | Social engineering, Free file host, Evasion |
Event coverage
| Message attribute |
|---|
| body |
| headers.auth_summary |
| sender.email |
| type |
Rule body MQL
type.inbound
and sender.email.email == "message@adobe.com"
and headers.auth_summary.spf.pass
and headers.auth_summary.dmarc.pass
and any(html.xpath(body.html,
"//td[@style[contains(., 'adobe-clean-display')]]/strong/a/text()"
).nodes,
strings.parse_email(.raw).domain.root_domain not in $org_domains
and strings.parse_email(.raw).email not in $recipient_emails
and strings.parse_email(.raw).email not in $sender_emails
and not (
strings.parse_email(.raw).domain.domain not in $free_email_providers
and strings.parse_email(.raw).domain.domain in $recipient_domains
and strings.parse_email(.raw).domain.domain in $sender_domains
)
)
Detection logic
Scope: inbound message.
Detects messages from Adobe Creative Cloud in which the document originates from a newly observed email address. The email address is extracted from the HTML body.
- inbound message
- sender.email.email is 'message@adobe.com'
- headers.auth_summary.spf.pass
- headers.auth_summary.dmarc.pass
any of
html.xpath(body.html, "//td[@style[contains(., 'adobe-clean-display')]]/strong/a/text()").nodeswhere all hold:- strings.parse_email(.raw).domain.root_domain not in $org_domains
- strings.parse_email(.raw).email not in $recipient_emails
- strings.parse_email(.raw).email not in $sender_emails
not:
all of:
- strings.parse_email(.raw).domain.domain not in $free_email_providers
- strings.parse_email(.raw).domain.domain in $recipient_domains
- strings.parse_email(.raw).domain.domain in $sender_domains
Inspects: body.html, headers.auth_summary.dmarc.pass, headers.auth_summary.spf.pass, sender.email.email, type.inbound. Sensors: html.xpath, strings.parse_email. Reference lists: $free_email_providers, $org_domains, $recipient_domains, $recipient_emails, $sender_domains, $sender_emails.
Indicators matched (1)
| Field | Match | Value |
|---|---|---|
sender.email.email | equals | message@adobe.com |