Attachment: DocuSign impersonation via PDF linking to new domain

 1name: "Attachment: DocuSign impersonation via PDF linking to new domain"
 2description: "This rule detects PDF files containing a DocuSign logo linking to a newly created domain (Less than or equal to 3 days)"
 3type: "rule"
 4severity: "medium"
 5source: |
 6  type.inbound
 7  and any(attachments,
 8          .file_type == "pdf"
 9          and any(ml.logo_detect(.).brands, .name == "DocuSign")
10          and any(file.explode(.),
11                  any(.scan.pdf.urls, network.whois(.domain).days_old <= 3)
12          )
13  )
14  
15  // negate highly trusted sender domains unless they fail DMARC authentication
16  and not (
17    sender.email.domain.root_domain in $high_trust_sender_root_domains
18    and coalesce(headers.auth_summary.dmarc.pass, false)
19  )
20  
21  // excludes senders that contain "via" in the display name a resilient way
22  and not (
23    any(headers.hops,
24        any(.fields,
25            .name == "X-Api-Host" and strings.ends_with(.value, "docusign.net")
26        )
27    )
28  )  
29attack_types:
30  - "Credential Phishing"
31tactics_and_techniques:
32  - "Impersonation: Brand"
33  - "PDF"
34  - "Social engineering"
35detection_methods:
36  - "Header analysis"
37  - "Sender analysis"
38  - "URL analysis"
39  - "File analysis"
40  - "Computer Vision"
41  - "Whois"
42id: "f0c96282-6eb9-5e84-aa9d-a48f66db5a74"