Detection rules › Sublime MQL
Brand impersonation: DocuSign PDF attachment with suspicious link
This rule detects DocuSign logos within PDF's that do not link to reputable domains, nor docusign themselves. This is typically indicative of Credential Phishing.
Threat classification
Sublime's own taxonomy (not MITRE ATT&CK).
| Category | Values |
|---|---|
| Attack types | Credential Phishing |
| Tactics and techniques | Impersonation: Brand, PDF, Social engineering |
Event coverage
| Message attribute |
|---|
| attachments (collection) |
| type |
Rule body MQL
type.inbound
and any(attachments,
.file_type == "pdf"
and any(ml.logo_detect(.).brands, .name == "DocuSign")
and any(file.explode(.),
length(.scan.url.urls) <= 9
and any(.scan.url.urls,
.domain.root_domain not in $tranco_1m
and .domain.root_domain not in $org_domains
and .domain.root_domain != "sublimesecurity.com"
and not strings.ilike(.domain.root_domain, "docusign.*")
)
)
and any(file.explode(.),
any(ml.nlu_classifier(.scan.ocr.raw).entities,
.name == "org" and .text == "DocuSign"
)
)
and any(file.explode(.),
any(ml.nlu_classifier(.scan.ocr.raw).entities,
.name == "request"
)
)
)
Detection logic
Scope: inbound message.
This rule detects DocuSign logos within PDF's that do not link to reputable domains, nor docusign themselves. This is typically indicative of Credential Phishing.
- inbound message
any of
attachmentswhere all hold:- .file_type is 'pdf'
any of
ml.logo_detect(.).brandswhere:- .name is 'DocuSign'
any of
file.explode(.)where all hold:- length(.scan.url.urls) ≤ 9
any of
.scan.url.urlswhere all hold:- .domain.root_domain not in $tranco_1m
- .domain.root_domain not in $org_domains
- .domain.root_domain is not 'sublimesecurity.com'
not:
- .domain.root_domain matches 'docusign.*'
any of
file.explode(.)where:any of
ml.nlu_classifier(.scan.ocr.raw).entitieswhere all hold:- .name is 'org'
- .text is 'DocuSign'
any of
file.explode(.)where:any of
ml.nlu_classifier(.scan.ocr.raw).entitieswhere:- .name is 'request'
Inspects: attachments[].file_type, type.inbound. Sensors: file.explode, ml.logo_detect, ml.nlu_classifier, strings.ilike. Reference lists: $org_domains, $tranco_1m.
Indicators matched (6)
| Field | Match | Value |
|---|---|---|
attachments[].file_type | equals | pdf |
ml.logo_detect(attachments[]).brands[].name | equals | DocuSign |
strings.ilike | substring | docusign.* |
ml.nlu_classifier(file.explode(attachments[])[].scan.ocr.raw).entities[].name | equals | org |
ml.nlu_classifier(file.explode(attachments[])[].scan.ocr.raw).entities[].text | equals | DocuSign |
ml.nlu_classifier(file.explode(attachments[])[].scan.ocr.raw).entities[].name | equals | request |