Brand impersonation: Fake DocuSign HTML table not linking to DocuSign domains

 1name: "Brand impersonation: Fake DocuSign HTML table not linking to DocuSign domains"
 2description: "Detects HTML table elements that mimick DocuSign templates linking to non-DocuSign destinations. The rule negates high trusted sender domains and legitimate replies."
 3type: "rule"
 4severity: "medium"
 5source: |
 6  type.inbound
 7  and length(attachments) == 0
 8  and (
 9    0 < length(body.links) < 10
10    // ignore link count when the HTML is padded with whitespace
11    // indicative of thread hijacking/copy-pasting
12    or regex.icount(body.html.raw, '(<br\s*/?>[\s\n]*)') > 50
13  )
14  and (
15    regex.icontains(body.html.raw, '<font size="[0-9]">DocuSign</font>')
16    or regex.icontains(body.html.raw, '<span[^>]*style="[^"]*">DocuSign<\/span>')
17    or regex.icontains(body.html.raw, '<strong>DocuSign</strong>')
18    or regex.icontains(body.html.raw,
19                       'D&#917540;&#917540;o&#917540;&#917540;c\x{FE00}uS&#917540;&#917540;i\x{FE00}gn'
20    )
21    or any(body.links, regex.icontains(.display_text, 'view.{0,3}doc'))
22    or any(body.links, regex.contains(.display_text, '\bDOCUMENT'))
23  )
24  and (
25    regex.icontains(body.html.raw, 'background:\s*rgb\(30,\s*76,\s*161\)')
26    or regex.icontains(body.html.raw,
27                       'background-color:\s*rgb\(30,\s*76,\s*161\)'
28    )
29    or regex.icontains(body.html.raw,
30                       'background-color:\s*rgb\(61,\s*170,\s*73\)'
31    )
32    or regex.icontains(body.html.raw,
33                       '<div[^>]*BACKGROUND-COLOR: #1e4ca1[^>]*>|<td[^>]*BACKGROUND-COLOR: #1e4ca1[^>]*>'
34    )
35    or regex.icontains(body.html.raw, 'background-color:#214e9f;')
36    or regex.icontains(body.html.raw, 'background-color:#3260a7')
37    or regex.icontains(body.html.raw,
38                       '<table[^>]*cellspacing="0"[^>]*cellpadding="0"[^>]*>\s*<tbody[^>]*>\s*<tr[^>]*>\s*<td[^>]*style="BACKGROUND:\s*rgb\(247,247,247\);\s*width:\s*[0-9]{2,3}px;\s*padding:20px;\s*margin:\s*[0-9]{2,3}px"[^>]*>.*<div[^>]*style="BACKGROUND:\s*rgb\(30,76,161\);\s*padding:[0-9]{2,3}px;\s*color:#EFEFEF"[^>]*align="center"[^>]*>.*DOCUMENT.*</a>'
39    )
40    // Docusign Blue Box template with button
41    or (
42      regex.icontains(body.html.raw,
43                      '<(td|div)[^>]*style="[^"]*background(-color)?:\s*(#1e4ca1|rgb\(30,\s*76,\s*161\))[^"]*"[^>]*>'
44      )
45      and (
46        regex.icontains(body.html.raw,
47                        '<a[^>]*style="[^"]*background-color:\s*(#[A-Fa-f0-9]{6}|rgb\([^)]*\))[^"]*"[^>]*>.*?<span[^>]*>.*?<\/span>.*?<\/a>'
48        )
49        // white link with a border
50        or (
51          regex.icontains(body.html.raw,
52                          '<a[^>]*style="[^"]*color:\s*(white|#fff|#ffffff|#FFF|#FFFFFF|rgb\(\s*255\s*,\s*255\s*,\s*255\s*\)|rgba\(\s*255\s*,\s*255\s*,\s*255\s*,\s*[0-9.]+\s*\)|rgb\(\s*100%\s*,\s*100%\s*,\s*100%\s*\))[^"]*"[^>]*>.*?<\/a>'
53          )
54          and regex.icontains(body.html.raw,
55                              '<a[^>]*style="[^"]*border:[^"]*"[^>]*>.*?<\/a>'
56          )
57        )
58      )
59    )
60  )
61  and any(body.links,
62          not strings.ilike(.href_url.domain.root_domain, "docusign.*")
63          and (
64            .display_text is null or regex.contains(.display_text, '\bDOCUMENT')
65          )
66  )
67  // negate highly trusted sender domains unless they fail DMARC authentication
68  and not (
69    sender.email.domain.root_domain in $high_trust_sender_root_domains
70    and coalesce(headers.auth_summary.dmarc.pass, false)
71  )
72  
73  // negate legit replies
74  and not (length(headers.references) > 0 or headers.in_reply_to is not null)
75  and not profile.by_sender().any_messages_benign
76  
77  // negate docusign X-Return-Path
78  and not any(headers.hops,
79              .index == 0
80              and any(.fields,
81                      .name == "X-Return-Path"
82                      and strings.ends_with(.value, "docusign.net")
83              )
84  )  
85attack_types:
86  - "Credential Phishing"
87tactics_and_techniques:
88  - "Impersonation: Brand"
89  - "Social engineering"
90detection_methods:
91  - "Content analysis"
92  - "HTML analysis"
93  - "Header analysis"
94  - "Sender analysis"
95  - "URL analysis"
96
97id: "28923dde-09fc-5b49-8263-ed2ab41b5c08"