Detection rules › Sublime MQL
Service abuse: Adobe legitimate domain with document approval language
Detects messages from Adobe's legitimate email domain containing suspicious language about document or payment approval that may indicate service abuse.
Threat classification
Sublime's own taxonomy (not MITRE ATT&CK).
| Category | Values |
|---|---|
| Attack types | BEC/Fraud, Credential Phishing |
| Tactics and techniques | Social engineering |
Event coverage
| Message attribute |
|---|
| body.current_thread |
| recipients.to (collection) |
| type |
Rule body MQL
type.inbound
and recipients.to[0].email.domain.domain == "email.adobe.com"
and regex.icontains(body.current_thread.text,
"(?:approved?|view) (?:document|payment)"
)
Detection logic
Scope: inbound message.
Detects messages from Adobe's legitimate email domain containing suspicious language about document or payment approval that may indicate service abuse.
- inbound message
- recipients.to[0].email.domain.domain is 'email.adobe.com'
- body.current_thread.text matches '(?:approved?|view) (?:document|payment)'
Inspects: body.current_thread.text, recipients.to[0].email.domain.domain, type.inbound. Sensors: regex.icontains.
Indicators matched (2)
| Field | Match | Value |
|---|---|---|
recipients.to[0].email.domain.domain | equals | email.adobe.com |
regex.icontains | regex | (?:approved?|view) (?:document|payment) |