Sublime Security medium experimental mql
Service abuse: Adobe message from newly registered domain
Detects messages legitimately sent through Adobe's messaging infrastructure that contain mailto links pointing to domains registered within the last 365 days.
Detection Logic
type.inbound
// from Adobe
and sender.email.email == 'message@adobe.com'
// sender has a recently created email domain
and any(filter(body.links, .href_url.scheme == 'mailto'),
network.whois(.href_url.domain).days_old < 365
)Field Validations
Loading…
Comments (0)
Loading comments...