heroui logo

Attachment: Adobe image lure in body or attachment with suspicious link

Sublime Rules

View Source
Summary
This detection rule is designed to identify phishing attempts that use Adobe images as lures, either embedded within the body of an email or as attachments. The rule checks for specific conditions that suggest a phishing email, such as the presence of Adobe logos, suspicious links, and the nature of the attachments. It employs a combination of content analysis, computer vision techniques for logo detection, and sender analysis to evaluate the legitimacy of the email. Key factors include the checking of attachments for image types, a limit on the number of links, and the scrutiny of the email headers for patterns typical of phishing attempts. Additional logic helps to filter out legitimate newsletters or communications from trusted domains, further honing in on potentially malicious emails.
Categories
  • Endpoint
  • Web
  • Cloud
  • Identity Management
Data Sources
  • User Account
  • Web Credential
  • Network Traffic
  • Application Log
Created: 2023-12-01