Service abuse: Adobe message from newly registered domain

 1name: "Service abuse: Adobe message from newly registered domain"
 2description: "Detects messages legitimately sent through Adobe's messaging infrastructure that contain mailto links pointing to domains registered within the last 365 days."
 3type: "rule"
 4severity: "medium"
 5source: |
 6  type.inbound
 7  // from Adobe
 8  and sender.email.email == 'message@adobe.com'
 9  // sender has a recently created email domain
10  and any(filter(body.links, .href_url.scheme == 'mailto'),
11          network.whois(.href_url.domain).days_old < 365
12  )  
13tags:
14  - "Attack surface reduction"
15attack_types:
16  - "Credential Phishing"
17tactics_and_techniques:
18  - "Evasion"
19  - "Social engineering"
20  - "Lookalike domain"
21detection_methods:
22  - "Sender analysis"
23  - "Header analysis"
24  - "URL analysis"
25  - "Whois"
26id: "9f7abbfe-5ecf-5686-a070-c1a465a1af80"