Detection rules › Sublime MQL
DocuSign impersonation via CloudHQ links
Identifies messages containing CloudHQ share links from senders outside the CloudHQ domain who are impersonating DocuSign in either the subject line or display name.
Threat classification
Sublime's own taxonomy (not MITRE ATT&CK).
| Category | Values |
|---|---|
| Attack types | Credential Phishing, BEC/Fraud |
| Tactics and techniques | Impersonation: Brand, Free file host |
Event coverage
| Message attribute |
|---|
| body |
| body.links (collection) |
| sender |
| sender.email |
| subject |
| type |
Rule body MQL
type.inbound
and any(body.links,
.href_url.domain.root_domain == "cloudhq.net"
and strings.starts_with(.href_url.path, "/s/")
and sender.email.domain.root_domain != 'cloudhq.net'
)
// the subject or display_name includes docusign
and (
regex.icontains(strings.replace_confusables(subject.subject),
'\bdocu\s*sign\b'
)
or regex.icontains(strings.replace_confusables(sender.display_name),
'\bdocu\s*sign\b'
)
)
// there is one unique cloudhq link in the message
and length(distinct(filter(body.links,
.href_url.domain.root_domain == "cloudhq.net"
),
.href_url.url
)
) <= 1
Detection logic
Scope: inbound message.
Identifies messages containing CloudHQ share links from senders outside the CloudHQ domain who are impersonating DocuSign in either the subject line or display name.
- inbound message
any of
body.linkswhere all hold:- .href_url.domain.root_domain is 'cloudhq.net'
- .href_url.path starts with '/s/'
- sender.email.domain.root_domain is not 'cloudhq.net'
any of:
- strings.replace_confusables(subject.subject) matches '\\bdocu\\s*sign\\b'
- strings.replace_confusables(sender.display_name) matches '\\bdocu\\s*sign\\b'
- length(distinct(filter(body.links, .href_url.domain.root_domain == 'cloudhq.net'), .href_url.url)) ≤ 1
Inspects: body.links, body.links[].href_url.domain.root_domain, body.links[].href_url.path, sender.display_name, sender.email.domain.root_domain, subject.subject, type.inbound. Sensors: regex.icontains, strings.replace_confusables, strings.starts_with.
Indicators matched (3)
| Field | Match | Value |
|---|---|---|
body.links[].href_url.domain.root_domain | equals | cloudhq.net |
strings.starts_with | prefix | /s/ |
regex.icontains | regex | \bdocu\s*sign\b |