Detection rules › Sublime MQL

DocuSign impersonation via CloudHQ links

Severity
medium
Type
rule
Source
github.com/sublime-security/sublime-rules

Identifies messages containing CloudHQ share links from senders outside the CloudHQ domain who are impersonating DocuSign in either the subject line or display name.

Threat classification

Sublime's own taxonomy (not MITRE ATT&CK).

CategoryValues
Attack typesCredential Phishing, BEC/Fraud
Tactics and techniquesImpersonation: Brand, Free file host

Event coverage

Rule body MQL

type.inbound
and any(body.links,
        .href_url.domain.root_domain == "cloudhq.net"
        and strings.starts_with(.href_url.path, "/s/")
        and sender.email.domain.root_domain != 'cloudhq.net'
)

// the subject or display_name includes docusign
and (
  regex.icontains(strings.replace_confusables(subject.subject),
                  '\bdocu\s*sign\b'
  )
  or regex.icontains(strings.replace_confusables(sender.display_name),
                     '\bdocu\s*sign\b'
  )
)

// there is one unique cloudhq link in the message
and length(distinct(filter(body.links,
                           .href_url.domain.root_domain == "cloudhq.net"
                    ),
                    .href_url.url
           )
) <= 1

Detection logic

Scope: inbound message.

Identifies messages containing CloudHQ share links from senders outside the CloudHQ domain who are impersonating DocuSign in either the subject line or display name.

  1. inbound message
  2. any of body.links where all hold:
    • .href_url.domain.root_domain is 'cloudhq.net'
    • .href_url.path starts with '/s/'
    • sender.email.domain.root_domain is not 'cloudhq.net'
  3. any of:
    • strings.replace_confusables(subject.subject) matches '\\bdocu\\s*sign\\b'
    • strings.replace_confusables(sender.display_name) matches '\\bdocu\\s*sign\\b'
  4. length(distinct(filter(body.links, .href_url.domain.root_domain == 'cloudhq.net'), .href_url.url)) ≤ 1

Inspects: body.links, body.links[].href_url.domain.root_domain, body.links[].href_url.path, sender.display_name, sender.email.domain.root_domain, subject.subject, type.inbound. Sensors: regex.icontains, strings.replace_confusables, strings.starts_with.

Indicators matched (3)

FieldMatchValue
body.links[].href_url.domain.root_domainequalscloudhq.net
strings.starts_withprefix/s/
regex.icontainsregex\bdocu\s*sign\b