Skip to content

New rule: (Service abuse) Behance gallery with sus redirect #3834

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
IndiaAce wants to merge 2 commits into from
Closed

New rule: (Service abuse) Behance gallery with sus redirect #3834

Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
8076fab
New rule: (Service abuse) Behance gallery with sus redirect
IndiaAce Jan 23, 2026
de5df6e
Auto-format MQL and add rule IDs
Jan 23, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
23 changes: 23 additions & 0 deletions detection-rules/service_abuse_behance_gallery_suspicious_redirect.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,23 @@
name: "Service abuse: Adobe Behance gallery with suspicious redirect"
description: "Detects messages containing a single Behance gallery link where the display URL shows Behance but the actual destination redirects elsewhere, indicating potential abuse of Adobe's Behance platform for malicious redirects."
type: "rule"
severity: "medium"
source: |
type.inbound
and length(body.links) > 0
and any(body.links,
.display_url.domain.root_domain == "behance.net"
and strings.contains(.display_url.path, '/gallery')
)
and length(filter(body.links, .href_url.domain.root_domain == "behance.net")) == 1

attack_types:
- "Credential Phishing"
- "Malware/Ransomware"
tactics_and_techniques:
- "Open redirect"
- "Evasion"
detection_methods:
- "URL analysis"
- "Sender analysis"
id: "5dfb387f-7b98-5f07-b68b-1652f5b698db"