Detection rules › Sublime MQL

Service abuse: DocSend share from newly registered domain

Severity
high
Type
rule
Source
github.com/sublime-security/sublime-rules

This Attack Surface Reduction (ASR) rule matches on DocSend notifications with recently registered reply-to domains.

Threat classification

Sublime's own taxonomy (not MITRE ATT&CK).

CategoryValues
Attack typesBEC/Fraud, Credential Phishing
Tactics and techniquesEvasion, Free file host, Impersonation: Brand, Social engineering

Event coverage

Rule body MQL

type.inbound

// Legitimate DocSend sending infratructure
and sender.email.email == "no-reply@docsend.com"
and headers.auth_summary.spf.pass
and headers.auth_summary.dmarc.pass

// the message needs to have a reply-to address
and length(headers.reply_to) > 0

// reply-to email address has never received an email from your org
and not any(headers.reply_to, .email.email in $recipient_emails)

// new reply-to
and any(headers.reply_to, network.whois(.email.domain).days_old < 30)

Detection logic

Scope: inbound message.

This Attack Surface Reduction (ASR) rule matches on DocSend notifications with recently registered reply-to domains.

  1. inbound message
  2. sender.email.email is 'no-reply@docsend.com'
  3. headers.auth_summary.spf.pass
  4. headers.auth_summary.dmarc.pass
  5. length(headers.reply_to) > 0
  6. not:
    • any of headers.reply_to where:
      • .email.email in $recipient_emails
  7. any of headers.reply_to where:
    • network.whois(.email.domain).days_old < 30

Inspects: headers.auth_summary.dmarc.pass, headers.auth_summary.spf.pass, headers.reply_to, headers.reply_to[].email.domain, headers.reply_to[].email.email, sender.email.email, type.inbound. Sensors: network.whois. Reference lists: $recipient_emails.

Indicators matched (1)

FieldMatchValue
sender.email.emailequalsno-reply@docsend.com