Detection rules › Sublime MQL
DocuSign impersonation via spoofed Intuit sender
Detects messages appearing to come from Intuit domains with authentication failures while masquerading as DocuSign communications. The sender fails either SPF or DMARC verification, and includes DocuSign branding in either the subject line or display name.
Threat classification
Sublime's own taxonomy (not MITRE ATT&CK).
| Category | Values |
|---|---|
| Attack types | Credential Phishing |
| Tactics and techniques | Impersonation: Brand, Spoofing |
Event coverage
| Message attribute |
|---|
| headers.auth_summary |
| sender |
| sender.email |
| subject |
| type |
Rule body MQL
type.inbound
and sender.email.domain.root_domain in ("intuit.com")
// email auth fails
and (
not headers.auth_summary.spf.pass
or not coalesce(headers.auth_summary.dmarc.pass, false)
)
// the subject or display_name includes docusign
and (
strings.icontains(subject.subject, "docusign")
or strings.icontains(sender.display_name, "docusign")
)
Detection logic
Scope: inbound message.
Detects messages appearing to come from Intuit domains with authentication failures while masquerading as DocuSign communications. The sender fails either SPF or DMARC verification, and includes DocuSign branding in either the subject line or display name.
- inbound message
- sender.email.domain.root_domain in ('intuit.com')
any of:
not:
- headers.auth_summary.spf.pass
not:
- coalesce(headers.auth_summary.dmarc.pass)
any of:
- subject.subject contains 'docusign'
- sender.display_name contains 'docusign'
Inspects: headers.auth_summary.dmarc.pass, headers.auth_summary.spf.pass, sender.display_name, sender.email.domain.root_domain, subject.subject, type.inbound. Sensors: strings.icontains.
Indicators matched (2)
| Field | Match | Value |
|---|---|---|
sender.email.domain.root_domain | member | intuit.com |
strings.icontains | substring | docusign |