Brand impersonation: Fake DocuSign HTML table not linking to DocuSign domains

  1name: "Brand impersonation: Fake DocuSign HTML table not linking to DocuSign domains"
  2description: "Detects HTML table elements that mimick DocuSign templates linking to non-DocuSign destinations. The rule negates high trusted sender domains and legitimate replies."
  3type: "rule"
  4severity: "medium"
  5source: |
  6  type.inbound
  7  and length(attachments) == 0
  8  and (
  9    0 < length(body.links) < 10
 10    // ignore link count when the HTML is padded with whitespace
 11    // indicative of thread hijacking/copy-pasting
 12    or regex.icount(body.html.raw, '(<br\s*/?>[\s\n]*)') > 50
 13  )
 14  and (
 15    regex.icontains(body.html.raw, '<font size="[0-9]">DocuSign</font>')
 16    or regex.icontains(body.html.raw, '<span[^>]*style="[^"]*">DocuSign<\/span>')
 17    or regex.icontains(body.html.raw, '<strong>DocuSign</strong>')
 18    or regex.icontains(body.html.raw,
 19                       'D&#917540;&#917540;o&#917540;&#917540;c\x{FE00}uS&#917540;&#917540;i\x{FE00}gn'
 20    )
 21    or any(body.links, regex.icontains(.display_text, 'view.{0,3}doc'))
 22    or any(body.links, regex.contains(.display_text, '\bDOCUMENT'))
 23  )
 24  and (
 25    regex.icontains(body.html.raw, 'background:\s*rgb\(30,\s*76,\s*161\)')
 26    or regex.icontains(body.html.raw,
 27                       'background-color:\s*rgb\(30,\s*76,\s*161\)'
 28    )
 29    or regex.icontains(body.html.raw,
 30                       'background-color:\s*rgb\(61,\s*170,\s*73\)'
 31    )
 32    or regex.icontains(body.html.raw,
 33                       '<div[^>]*BACKGROUND-COLOR: #1e4ca1[^>]*>|<td[^>]*BACKGROUND-COLOR: #1e4ca1[^>]*>'
 34    )
 35    or regex.icontains(body.html.raw, 'background-color:#214e9f;')
 36    or regex.icontains(body.html.raw, 'background-color:#3260a7')
 37    or regex.icontains(body.html.raw,
 38                       '<table[^>]*cellspacing="0"[^>]*cellpadding="0"[^>]*>\s*<tbody[^>]*>\s*<tr[^>]*>\s*<td[^>]*style="BACKGROUND:\s*rgb\(247,247,247\);\s*width:\s*[0-9]{2,3}px;\s*padding:20px;\s*margin:\s*[0-9]{2,3}px"[^>]*>.*<div[^>]*style="BACKGROUND:\s*rgb\(30,76,161\);\s*padding:[0-9]{2,3}px;\s*color:#EFEFEF"[^>]*align="center"[^>]*>.*DOCUMENT.*</a>'
 39    )
 40    // Docusign Blue Box template with button
 41    or (
 42      regex.icontains(body.html.raw,
 43                      '<(td|div)[^>]*style="[^"]*background(-color)?:\s*(#1e4ca1|rgb\(30,\s*76,\s*161\))[^"]*"[^>]*>'
 44      )
 45      and (
 46        regex.icontains(body.html.raw,
 47                        '<a[^>]*style="[^"]*background-color:\s*(#[A-Fa-f0-9]{6}|rgb\([^)]*\))[^"]*"[^>]*>.*?<span[^>]*>.*?<\/span>.*?<\/a>'
 48        )
 49        // white link with a border
 50        or (
 51          regex.icontains(body.html.raw,
 52                          '<a[^>]*style="[^"]*color:\s*(white|#fff|#ffffff|#FFF|#FFFFFF|rgb\(\s*255\s*,\s*255\s*,\s*255\s*\)|rgba\(\s*255\s*,\s*255\s*,\s*255\s*,\s*[0-9.]+\s*\)|rgb\(\s*100%\s*,\s*100%\s*,\s*100%\s*\))[^"]*"[^>]*>.*?<\/a>'
 53          )
 54          and regex.icontains(body.html.raw,
 55                              '<a[^>]*style="[^"]*border:[^"]*"[^>]*>.*?<\/a>'
 56          )
 57        )
 58      )
 59    )
 60  )
 61  and any(body.links,
 62          not strings.ilike(.href_url.domain.root_domain, "docusign.*")
 63          and (
 64            .display_text is null or regex.contains(.display_text, '\bDOCUMENT')
 65          )
 66  )
 67  // negate highly trusted sender domains unless they fail DMARC authentication
 68  and (
 69    (
 70      sender.email.domain.root_domain in $high_trust_sender_root_domains
 71      and (
 72        any(distinct(headers.hops, .authentication_results.dmarc is not null),
 73            strings.ilike(.authentication_results.dmarc, "*fail")
 74        )
 75      )
 76    )
 77    or sender.email.domain.root_domain not in $high_trust_sender_root_domains
 78  )
 79  
 80  // negate legit replies
 81  and not (length(headers.references) > 0 or headers.in_reply_to is not null)
 82  and not profile.by_sender().any_messages_benign
 83  
 84  // negate docusign X-Return-Path
 85  and not any(headers.hops,
 86              .index == 0
 87              and any(.fields,
 88                      .name == "X-Return-Path"
 89                      and strings.ends_with(.value, "docusign.net")
 90              )
 91  )  
 92attack_types:
 93  - "Credential Phishing"
 94tactics_and_techniques:
 95  - "Impersonation: Brand"
 96  - "Social engineering"
 97detection_methods:
 98  - "Content analysis"
 99  - "HTML analysis"
100  - "Header analysis"
101  - "Sender analysis"
102  - "URL analysis"
103
104id: "28923dde-09fc-5b49-8263-ed2ab41b5c08"