Detection rules › Sublime MQL
Brand impersonation: DocuSign with embedded QR code
This rule detects unsolicited messages with short bodies containing a DocuSign logo, QR code language and an embedded QR code.
Threat classification
Sublime's own taxonomy (not MITRE ATT&CK).
| Category | Values |
|---|---|
| Attack types | Credential Phishing |
| Tactics and techniques | Evasion, Image as content, Impersonation: Brand, QR code |
Event coverage
| Message attribute |
|---|
| body.current_thread |
| headers.auth_summary |
| sender.email |
| type |
Rule body MQL
type.inbound
and length(body.current_thread.text) < 1000
and length(attachments) == 0
and regex.icontains(body.current_thread.text, '\bQ(\.)?R(\.)?\b')
and regex.icontains(body.current_thread.text, "scan|mobile|camera")
and any(ml.logo_detect(file.message_screenshot()).brands,
strings.starts_with(.name, "DocuSign")
)
//
// This rule makes use of a beta feature and is subject to change without notice
// using the beta feature in custom rules is not suggested until it has been formally released
//
and any(beta.scan_qr(file.message_screenshot()).items,
.type is not null and regex.contains(.data, '\.')
)
// negate highly trusted sender domains unless they fail DMARC authentication
and (
(
sender.email.domain.root_domain in $high_trust_sender_root_domains
and not headers.auth_summary.dmarc.pass
)
or sender.email.domain.root_domain not in $high_trust_sender_root_domains
)
Detection logic
Scope: inbound message.
This rule detects unsolicited messages with short bodies containing a DocuSign logo, QR code language and an embedded QR code.
- inbound message
- length(body.current_thread.text) < 1000
- length(attachments) is 0
- body.current_thread.text matches '\\bQ(\\.)?R(\\.)?\\b'
- body.current_thread.text matches 'scan|mobile|camera'
any of
ml.logo_detect(file.message_screenshot()).brandswhere:- .name starts with 'DocuSign'
any of
beta.scan_qr(file.message_screenshot()).itemswhere all hold:- .type is set
- .data matches '\\.'
any of:
all of:
- sender.email.domain.root_domain in $high_trust_sender_root_domains
not:
- headers.auth_summary.dmarc.pass
- sender.email.domain.root_domain not in $high_trust_sender_root_domains
Inspects: body.current_thread.text, headers.auth_summary.dmarc.pass, sender.email.domain.root_domain, type.inbound. Sensors: beta.scan_qr, file.message_screenshot, ml.logo_detect, regex.contains, regex.icontains, strings.starts_with. Reference lists: $high_trust_sender_root_domains.
Indicators matched (4)
| Field | Match | Value |
|---|---|---|
regex.icontains | regex | \bQ(\.)?R(\.)?\b |
regex.icontains | regex | scan|mobile|camera |
strings.starts_with | prefix | DocuSign |
regex.contains | regex | \. |