Fake Adobe Document Cloud Phishing Campaign Detected
This rule detects potential phishing attempts impersonating Adobe Document Cloud. It looks for emails with subjects containing keywords like "Adobe", "Document Cloud", "Sign Document", or "View Document", but where the sender's domain is NOT a legitimate Adobe domain (adobe.com or documentcloud.adobe.com). The rule then counts these occurrences per sender address and domain over a daily period.
Microsoft Sentinel (KQL)
