Detection rules › Sublime MQL

Brand impersonation: DocuSign with embedded QR code

Severity
high
Type
rule
Source
github.com/sublime-security/sublime-rules

This rule detects unsolicited messages with short bodies containing a DocuSign logo, QR code language and an embedded QR code.

Threat classification

Sublime's own taxonomy (not MITRE ATT&CK).

CategoryValues
Attack typesCredential Phishing
Tactics and techniquesEvasion, Image as content, Impersonation: Brand, QR code

Event coverage

Rule body MQL

type.inbound
and length(body.current_thread.text) < 1000
and length(attachments) == 0
and regex.icontains(body.current_thread.text, '\bQ(\.)?R(\.)?\b')
and regex.icontains(body.current_thread.text, "scan|mobile|camera")
and any(ml.logo_detect(file.message_screenshot()).brands,
        strings.starts_with(.name, "DocuSign")
)
//
// This rule makes use of a beta feature and is subject to change without notice
// using the beta feature in custom rules is not suggested until it has been formally released
//
and any(beta.scan_qr(file.message_screenshot()).items,
        .type is not null and regex.contains(.data, '\.')
)
// negate highly trusted sender domains unless they fail DMARC authentication
and (
  (
    sender.email.domain.root_domain in $high_trust_sender_root_domains
    and not headers.auth_summary.dmarc.pass
  )
  or sender.email.domain.root_domain not in $high_trust_sender_root_domains
)

Detection logic

Scope: inbound message.

This rule detects unsolicited messages with short bodies containing a DocuSign logo, QR code language and an embedded QR code.

  1. inbound message
  2. length(body.current_thread.text) < 1000
  3. length(attachments) is 0
  4. body.current_thread.text matches '\\bQ(\\.)?R(\\.)?\\b'
  5. body.current_thread.text matches 'scan|mobile|camera'
  6. any of ml.logo_detect(file.message_screenshot()).brands where:
    • .name starts with 'DocuSign'
  7. any of beta.scan_qr(file.message_screenshot()).items where all hold:
    • .type is set
    • .data matches '\\.'
  8. any of:
    • all of:
      • sender.email.domain.root_domain in $high_trust_sender_root_domains
      • not:
        • headers.auth_summary.dmarc.pass
    • sender.email.domain.root_domain not in $high_trust_sender_root_domains

Inspects: body.current_thread.text, headers.auth_summary.dmarc.pass, sender.email.domain.root_domain, type.inbound. Sensors: beta.scan_qr, file.message_screenshot, ml.logo_detect, regex.contains, regex.icontains, strings.starts_with. Reference lists: $high_trust_sender_root_domains.

Indicators matched (4)

FieldMatchValue
regex.icontainsregex\bQ(\.)?R(\.)?\b
regex.icontainsregexscan|mobile|camera
strings.starts_withprefixDocuSign
regex.containsregex\.