Service abuse: Adobe share containing newly observed email address domain

calendar Jul 31, 2026  ·
Share on: linkedin copy

Detects legitimate Adobe notification emails that contain a genuine Adobe-hosted document link alongside a mailto link with an external email address that is not the recipient, not part of the organization's domains, not associated with Adobe, and has never been observed in prior inbound or outbound mail. This pattern indicates abuse of Adobe's trusted email infrastructure to redirect victims into contacting an attacker-controlled address outside the normal mail flow.

Sublime rule (View on GitHub)

 1name: "Service abuse: Adobe share containing newly observed email address domain"
 2description: "Detects legitimate Adobe notification emails that contain a genuine Adobe-hosted document link alongside a mailto link with an external email address that is not the recipient, not part of the organization's domains, not associated with Adobe, and has never been observed in prior inbound or outbound mail. This pattern indicates abuse of Adobe's trusted email infrastructure to redirect victims into contacting an attacker-controlled address outside the normal mail flow."
 3type: "rule"
 4severity: "high"
 5source: |
 6  type.inbound
 7  // from Adobe
 8  and sender.email.email == 'message@adobe.com'
 9  // the email address in the body
10  and any(filter(body.links,
11                 .href_url.scheme == 'mailto'
12                 // is not the recipient
13                 and .href_url.url !~ recipients.to[0].email.email
14                 // not in org domains
15                 and .href_url.domain.domain not in $org_domains
16                 // and not adobe
17                 and .href_url.domain.root_domain != "adobe.com"
18          ),
19          // and has not been observed inbound/outbound in the environment
20          .href_url.domain.domain not in $sender_domains
21          and .href_url.domain.domain not in $recipient_domains
22  )
23  // there is a single link to an adobe hosted content
24  and length(distinct(filter(body.links,
25                             .href_url.domain.root_domain == "adobe.com"
26                             and strings.istarts_with(.href_url.path, '/id/urn:')
27                      ),
28                      .href_url.url
29             )
30  ) == 1  
31attack_types:
32  - "Credential Phishing"
33  - "BEC/Fraud"
34tactics_and_techniques:
35  - "Out of band pivot"
36  - "Social engineering"
37detection_methods:
38  - "URL analysis"
39  - "Sender analysis"
40  - "Content analysis"
41id: "35605b1f-f640-53ae-8dfb-59ecba1d0e09"
to-top