Detection rules › Sublime MQL
Brand impersonation: Figma with malicious document access overlay
"Detects malicious Figma design shares containing brand impersonation or credential phishing content. The rule identifies legitimate Figma share notifications where the embedded thumbnail preview contains "access document" text when OCR'd. Attackers create phishing designs (impersonating Microsoft, DocuSign, or other brands) within Figma, then share them via Figma's legitimate infrastructure to bypass sender reputation checks. The malicious content is rendered in the Figma-hosted thumbnail image itself."
Threat classification
Sublime's own taxonomy (not MITRE ATT&CK).
| Category | Values |
|---|---|
| Attack types | Credential Phishing |
| Tactics and techniques | Impersonation: Brand, Social engineering, Image as content |
Event coverage
| Message attribute |
|---|
| body |
| sender.email |
| subject |
| type |
Rule body MQL
type.inbound
and sender.email.email == "no-reply@email.figma.com"
and strings.icontains(subject.base, "proposal")
and length(html.xpath(body.html,
"//img[contains(@src, 'https://api-cdn.figma.com/resize/thumbnails')]"
).nodes
) == 1
//
// This rule makes use of a beta feature and is subject to change without notice
// using the beta feature in custom rules is not suggested until it has been formally released
//
and strings.icontains(beta.ocr(file.message_screenshot()).text,
'access document'
)
Detection logic
Scope: inbound message.
"Detects malicious Figma design shares containing brand impersonation or credential phishing content. The rule identifies legitimate Figma share notifications where the embedded thumbnail preview contains "access document" text when OCR'd. Attackers create phishing designs (impersonating Microsoft, DocuSign, or other brands) within Figma, then share them via Figma's legitimate infrastructure to bypass sender reputation checks. The malicious content is rendered in the Figma-hosted thumbnail image itself."
- inbound message
- sender.email.email is 'no-reply@email.figma.com'
- subject.base contains 'proposal'
- length(html.xpath(body.html, "//img[contains(@src, 'https://api-cdn.figma.com/resize/thumbnails')]").nodes) is 1
- beta.ocr(file.message_screenshot()).text contains 'access document'
Inspects: body.html, sender.email.email, subject.base, type.inbound. Sensors: beta.ocr, file.message_screenshot, html.xpath, strings.icontains.
Indicators matched (3)
| Field | Match | Value |
|---|---|---|
sender.email.email | equals | no-reply@email.figma.com |
strings.icontains | substring | proposal |
strings.icontains | substring | access document |