sublimemediumRule

Brand impersonation: MyChart

Detects inbound messages impersonating MyChart, the patient portal brand, by using a display name containing 'mychart' combined with common lure phrases such as 'claim your reward', 'member rewards', 'feedback survey', or 'medicare kit'. The rule also flags messages sent from recently registered domains. Legitimate senders from trusted MyChart-related domains that pass DMARC authentication, as well as designated high-trust sender domains, are excluded.

MITRE ATT&CK

T1566 T1566.001 T1566.002 T1598 T1598.003

initial-access

Detection Query

type.inbound
and strings.icontains(sender.display_name, "mychart")
and (
  (
    strings.icontains(body.current_thread.text, "mychart")
    and 2 of (
      strings.icontains(body.current_thread.text, "claim your reward"),
      strings.icontains(body.current_thread.text, "feedback survey"),
      strings.icontains(body.current_thread.text, "invited to participate"),
      strings.icontains(body.current_thread.text, "medicare kit"),
      strings.icontains(body.current_thread.text, "member rewards"),
      strings.icontains(body.current_thread.text, "member appreciation"),
      strings.icontains(body.current_thread.text, "log in to mychart"),
      regex.icontains(body.current_thread.text, '©\s*(?:\d+)\s*mychart')
    )
  )
  or strings.icontains(subject.base, "medicare kit")
  or network.whois(sender.email.domain).days_old < 365
)
and not (
  sender.email.domain.root_domain in (
    "epic-notification.com",
    "myhealthconnect.org"
  )
  and coalesce(headers.auth_summary.dmarc.pass, false)
)
// negate highly trusted sender domains unless they fail DMARC authentication
and not (
  sender.email.domain.root_domain in $high_trust_sender_root_domains
  and coalesce(headers.auth_summary.dmarc.pass, false)
)

Data Sources

Email MessagesEmail HeadersEmail Attachments

Platforms

Raw Content

name: "Brand impersonation: MyChart"
description: "Detects inbound messages impersonating MyChart, the patient portal brand, by using a display name containing 'mychart' combined with common lure phrases such as 'claim your reward', 'member rewards', 'feedback survey', or 'medicare kit'. The rule also flags messages sent from recently registered domains. Legitimate senders from trusted MyChart-related domains that pass DMARC authentication, as well as designated high-trust sender domains, are excluded."
type: "rule"
severity: "medium"
source: |
  type.inbound
  and strings.icontains(sender.display_name, "mychart")
  and (
    (
      strings.icontains(body.current_thread.text, "mychart")
      and 2 of (
        strings.icontains(body.current_thread.text, "claim your reward"),
        strings.icontains(body.current_thread.text, "feedback survey"),
        strings.icontains(body.current_thread.text, "invited to participate"),
        strings.icontains(body.current_thread.text, "medicare kit"),
        strings.icontains(body.current_thread.text, "member rewards"),
        strings.icontains(body.current_thread.text, "member appreciation"),
        strings.icontains(body.current_thread.text, "log in to mychart"),
        regex.icontains(body.current_thread.text, '©\s*(?:\d+)\s*mychart')
      )
    )
    or strings.icontains(subject.base, "medicare kit")
    or network.whois(sender.email.domain).days_old < 365
  )
  and not (
    sender.email.domain.root_domain in (
      "epic-notification.com",
      "myhealthconnect.org"
    )
    and coalesce(headers.auth_summary.dmarc.pass, false)
  )
  // negate highly trusted sender domains unless they fail DMARC authentication
  and not (
    sender.email.domain.root_domain in $high_trust_sender_root_domains
    and coalesce(headers.auth_summary.dmarc.pass, false)
  )
attack_types:
  - "Credential Phishing"
  - "Spam"
tactics_and_techniques:
  - "Impersonation: Brand"
  - "Social engineering"
  - "Spoofing"
detection_methods:
  - "Content analysis"
  - "Natural Language Understanding"
  - "Header analysis"
  - "Sender analysis"
id: "8be6743d-8d17-53ef-97c7-cb00f2b27374"