Update impersonation_adobe_suspicious_language_link.yml

[aidenmitchell]

Description

This pull request updates the detection logic in the impersonation_adobe_suspicious_language_link.yml rule to enhance its accuracy and reduce false positives. The changes focus on refining conditions for detecting Adobe-related impersonation attempts by incorporating additional checks and improving sender profile evaluation.

Enhancements to detection logic:

• Added a new condition to check if the email body contains the term "adobe" and matches a specific machine-learned topic ("File Sharing and Cloud Services"). This complements the existing logo detection logic for identifying Adobe-related content.

Improvements to sender profile evaluation:

• Updated the logic to include a condition that flags emails if the sender's email has not been in contact for more than 14 days (profile.by_sender_email().days_since.last_contact > 14).
• Added a condition to exclude senders with any benign message history (not profile.by_sender().any_messages_benign) to reduce false positives.

Associated samples

• https://platform.sublime.security/messages/e9ae225a5daeff88ac029d99183efe4d90a2ee54c7c14f1c313073e612fd3b6e?preview_id=0196b4d9-197c-7ac9-be3c-b207f8aa84a1