This rule detects an abuse pattern where legitimate Adobe notification emails carry a genuine Adobe-hosted document link alongside a malicious mailto link targeting an external address outside the recipient’s organization, not belonging to Adobe, and unseen in prior inbound/outbound mail. Specifically, it looks for emails from message@adobe.com in which the body contains a mailto link to an external address that is not the recipient, not part of the organization’s domains, and has not been observed in prior mail flows. It also enforces that there is exactly one Adobe-hosted link (rooted at adobe.com) to content with a path starting with /id/urn:. This combination indicates the attacker is abusing Adobe’s trusted infrastructure to guide victims to contact an attacker-controlled address, a form of credential phishing/BEC. The rule uses URL analysis (validating mailto and domain contexts), sender analysis (verifying Adobe as the source), and content analysis (link patterns) to confirm the scenario. It is designed to be triggered when a newly observed external domain appears in the mail that is not in the org, not associated with Adobe, and not previously seen in mail traffic, while maintaining a single Adobe-hosted link to content to anchor the exploit. Operationally, the rule relies on maintaining context about known org domains and observed sender/recipient domains to reduce false positives from legitimate Adobe communications or standard mail workflows.