Detection rules › Sublime MQL

Service abuse: Adobe legitimate domain with document approval language

Severity
medium
Type
rule
Source
github.com/sublime-security/sublime-rules

Detects messages from Adobe's legitimate email domain containing suspicious language about document or payment approval that may indicate service abuse.

Threat classification

Sublime's own taxonomy (not MITRE ATT&CK).

CategoryValues
Attack typesBEC/Fraud, Credential Phishing
Tactics and techniquesSocial engineering

Event coverage

Rule body MQL

type.inbound
and recipients.to[0].email.domain.domain == "email.adobe.com"
and regex.icontains(body.current_thread.text,
                    "(?:approved?|view) (?:document|payment)"
)

Detection logic

Scope: inbound message.

Detects messages from Adobe's legitimate email domain containing suspicious language about document or payment approval that may indicate service abuse.

  1. inbound message
  2. recipients.to[0].email.domain.domain is 'email.adobe.com'
  3. body.current_thread.text matches '(?:approved?|view) (?:document|payment)'

Inspects: body.current_thread.text, recipients.to[0].email.domain.domain, type.inbound. Sensors: regex.icontains.

Indicators matched (2)

FieldMatchValue
recipients.to[0].email.domain.domainequalsemail.adobe.com
regex.icontainsregex(?:approved?|view) (?:document|payment)