sublimemediumRule

Service abuse: Adobe message from newly registered domain

Detects messages legitimately sent through Adobe's messaging infrastructure that contain mailto links pointing to domains registered within the last 365 days.

MITRE ATT&CK

T1566 T1566.001 T1566.002 T1598 T1036 T1027 T1583.001

defense-evasioninitial-access

Detection Query

type.inbound
// from Adobe
and sender.email.email == 'message@adobe.com'
// sender has a recently created email domain
and any(filter(body.links, .href_url.scheme == 'mailto'),
        network.whois(.href_url.domain).days_old < 365
)

Data Sources

Email MessagesEmail HeadersEmail Attachments

Platforms

Tags

Attack surface reduction

Raw Content

name: "Service abuse: Adobe message from newly registered domain"
description: "Detects messages legitimately sent through Adobe's messaging infrastructure that contain mailto links pointing to domains registered within the last 365 days."
type: "rule"
severity: "medium"
source: |
  type.inbound
  // from Adobe
  and sender.email.email == 'message@adobe.com'
  // sender has a recently created email domain
  and any(filter(body.links, .href_url.scheme == 'mailto'),
          network.whois(.href_url.domain).days_old < 365
  )
tags:
  - "Attack surface reduction"
attack_types:
  - "Credential Phishing"
tactics_and_techniques:
  - "Evasion"
  - "Social engineering"
  - "Lookalike domain"
detection_methods:
  - "Sender analysis"
  - "Header analysis"
  - "URL analysis"
  - "Whois"
id: "9f7abbfe-5ecf-5686-a070-c1a465a1af80"