Detection rules › Sublime MQL
Brand impersonation: DocuSign (QR code)
Detects messages using DocuSign image based lures, referencing or including a QR code from an Unsolicited sender. These messages often lead users to phishing sites or initiate unwanted downloads.
Threat classification
Sublime's own taxonomy (not MITRE ATT&CK).
| Category | Values |
|---|---|
| Attack types | Credential Phishing |
| Tactics and techniques | Impersonation: Brand, PDF, QR code, Social engineering |
Event coverage
| Message attribute |
|---|
| attachments (collection) |
| headers.auth_summary |
| sender.email |
| type |
Rule body MQL
type.inbound
and any(attachments,
(.file_type in $file_types_images or .file_type == "pdf")
and (
any(ml.logo_detect(.).brands,
.name == "DocuSign" and .confidence in ("medium", "high")
)
or any(ml.logo_detect(file.message_screenshot()).brands,
.name == "DocuSign"
)
)
and (
any(file.explode(.),
(
(
.scan.qr.type is not null
and regex.contains(.scan.qr.data, '\.')
)
or
// QR code language
(
regex.icontains(.scan.ocr.raw, 'scan|camera')
and regex.icontains(.scan.ocr.raw, '\bQR\b|Q\.R\.|barcode')
)
)
// exclude images taken with mobile cameras and screenshots from android
and not any(.scan.exiftool.fields,
.key == "Model"
or (
.key == "Software"
and strings.starts_with(.value, "Android")
)
)
// exclude images taken with mobile cameras and screenshots from Apple
and not any(.scan.exiftool.fields,
.key == "DeviceManufacturer"
and .value == "Apple Computer Inc."
)
)
)
)
and not (
sender.email.domain.root_domain in ("docusign.net", "docusign.com")
and headers.auth_summary.dmarc.pass
)
Detection logic
Scope: inbound message.
Detects messages using DocuSign image based lures, referencing or including a QR code from an Unsolicited sender. These messages often lead users to phishing sites or initiate unwanted downloads.
- inbound message
any of
attachmentswhere all hold:any of:
- .file_type in $file_types_images
- .file_type is 'pdf'
any of:
any of
ml.logo_detect(.).brandswhere all hold:- .name is 'DocuSign'
- .confidence in ('medium', 'high')
any of
ml.logo_detect(file.message_screenshot()).brandswhere:- .name is 'DocuSign'
any of
file.explode(.)where all hold:any of:
all of:
- .scan.qr.type is set
- .scan.qr.data matches '\\.'
all of:
- .scan.ocr.raw matches 'scan|camera'
- .scan.ocr.raw matches '\\bQR\\b|Q\\.R\\.|barcode'
not:
any of
.scan.exiftool.fieldswhere any holds:- .key is 'Model'
all of:
- .key is 'Software'
- .value starts with 'Android'
not:
any of
.scan.exiftool.fieldswhere all hold:- .key is 'DeviceManufacturer'
- .value is 'Apple Computer Inc.'
not:
all of:
- sender.email.domain.root_domain in ('docusign.net', 'docusign.com')
- headers.auth_summary.dmarc.pass
Inspects: attachments[].file_type, headers.auth_summary.dmarc.pass, sender.email.domain.root_domain, type.inbound. Sensors: file.explode, file.message_screenshot, ml.logo_detect, regex.contains, regex.icontains, strings.starts_with. Reference lists: $file_types_images.
Indicators matched (15)
| Field | Match | Value |
|---|---|---|
attachments[].file_type | equals | pdf |
ml.logo_detect(attachments[]).brands[].name | equals | DocuSign |
ml.logo_detect(attachments[]).brands[].confidence | member | medium |
ml.logo_detect(attachments[]).brands[].confidence | member | high |
ml.logo_detect(file.message_screenshot()).brands[].name | equals | DocuSign |
regex.contains | regex | \. |
regex.icontains | regex | scan|camera |
regex.icontains | regex | \bQR\b|Q\.R\.|barcode |
file.explode(attachments[])[].scan.exiftool.fields[].key | equals | Model |
file.explode(attachments[])[].scan.exiftool.fields[].key | equals | Software |
strings.starts_with | prefix | Android |
file.explode(attachments[])[].scan.exiftool.fields[].key | equals | DeviceManufacturer |
3 more
file.explode(attachments[])[].scan.exiftool.fields[].value | equals | Apple Computer Inc. |
sender.email.domain.root_domain | member | docusign.net |
sender.email.domain.root_domain | member | docusign.com |