sublimemediumRule

Credential phishing: Personalized document signing request

Detects messages with a single recipient and personalized document signing requests. The rule identifies messages referencing DocuSign or document-related language, combined with domain-specific greeting patterns or known malicious HTML artifacts associated with fraudulent signing invitations from entities such as STAR Capital or Agito AS.

MITRE ATT&CK

T1566 T1566.001 T1566.002 T1598 T1534 T1656 T1598.003

initial-access

Detection Query

type.inbound
// personalized document form ensures recipients should always be 1
and length(recipients.to) == 1
and 2 of (
  // document/sign language
  strings.icontains(body.current_thread.text, 'docusign', 'document'),
  // greeting uses recipient's email local_part
  any(recipients.to,
      strings.icontains(body.current_thread.text,
                        strings.concat("You're receiving this on behalf of ",
                                       .email.domain.sld
                        )
      )
      or strings.icontains(body.current_thread.text,
                           strings.concat("Invitation to sign document for ",
                                          .email.domain.sld
                           )
      )
  ),
  // templated html artifact
  strings.contains(body.html.raw,
                   'STAR Capital invites you to exchange',
                   'Reminder: Invitation to sign document for Agito AS'
  )
)

Data Sources

Email MessagesEmail HeadersEmail Attachments

Platforms

Raw Content

name: "Credential phishing: Personalized document signing request"
description: "Detects messages with a single recipient and personalized document signing requests. The rule identifies messages referencing DocuSign or document-related language, combined with domain-specific greeting patterns or known malicious HTML artifacts associated with fraudulent signing invitations from entities such as STAR Capital or Agito AS."
type: "rule"
severity: "medium"
source: |
  type.inbound
  // personalized document form ensures recipients should always be 1
  and length(recipients.to) == 1
  and 2 of (
    // document/sign language
    strings.icontains(body.current_thread.text, 'docusign', 'document'),
    // greeting uses recipient's email local_part
    any(recipients.to,
        strings.icontains(body.current_thread.text,
                          strings.concat("You're receiving this on behalf of ",
                                         .email.domain.sld
                          )
        )
        or strings.icontains(body.current_thread.text,
                             strings.concat("Invitation to sign document for ",
                                            .email.domain.sld
                             )
        )
    ),
    // templated html artifact
    strings.contains(body.html.raw,
                     'STAR Capital invites you to exchange',
                     'Reminder: Invitation to sign document for Agito AS'
    )
  )
attack_types:
  - "Credential Phishing"
  - "BEC/Fraud"
tactics_and_techniques:
  - "Impersonation: Brand"
  - "Social engineering"
detection_methods:
  - "Content analysis"
  - "HTML analysis"
id: "367978c7-f850-571f-8b8f-7076ff6a9aca"