Detection rules › Sublime MQL
Brand impersonation: Xodo Sign
Detects messages impersonating Xodo Sign with 'Processed by Xodo Sign' text from unauthorized senders that fail DMARC authentication.
Threat classification
Sublime's own taxonomy (not MITRE ATT&CK).
| Category | Values |
|---|---|
| Attack types | Credential Phishing |
| Tactics and techniques | Impersonation: Brand, Social engineering |
Event coverage
| Message attribute |
|---|
| body.current_thread |
| headers.auth_summary |
| sender.email |
| type |
Rule body MQL
type.inbound
and strings.icontains(body.current_thread.text, "processed by xodo sign")
and not (
sender.email.domain.root_domain == "eversign.com"
and headers.auth_summary.dmarc.pass
)
Detection logic
Scope: inbound message.
Detects messages impersonating Xodo Sign with 'Processed by Xodo Sign' text from unauthorized senders that fail DMARC authentication.
- inbound message
- body.current_thread.text contains 'processed by xodo sign'
not:
all of:
- sender.email.domain.root_domain is 'eversign.com'
- headers.auth_summary.dmarc.pass
Inspects: body.current_thread.text, headers.auth_summary.dmarc.pass, sender.email.domain.root_domain, type.inbound. Sensors: strings.icontains.
Indicators matched (2)
| Field | Match | Value |
|---|---|---|
strings.icontains | substring | processed by xodo sign |
sender.email.domain.root_domain | equals | eversign.com |