Credential phishing: Suspicious e-sign agreement document notification
Detects phishing attempts disguised as e-signature requests, characterized by common document sharing phrases, unusual HTML padding, and suspicious link text.
Sublime rule (View on GitHub)
1name: "Credential phishing: Suspicious e-sign agreement document notification"
2description: "Detects phishing attempts disguised as e-signature requests, characterized by common document sharing phrases, unusual HTML padding, and suspicious link text."
3type: "rule"
4severity: "medium"
5source: |
6 type.inbound
7 and (
8 any([subject.subject, sender.display_name],
9 regex.icontains(strings.replace_confusables(.),
10 "D[0o]cuLink",
11 "Agreement",
12 "Access.&.Appr[0o]ved",
13 "Agreement.{0,5}Review",
14 "Attend.and.Review",
15 "action.re?quired",
16 "AuthentiSign",
17 "Completed.File",
18 "D[0o]chsared",
19 "D[0o]cshared",
20 "D[0o]csPoint",
21 "D[0o]cument.Shared",
22 "D[0o]cuCentre",
23 "D[0o]cuCenter",
24 "D[0o]cCenter",
25 "D[0o]csOnline",
26 "D[0o]cSend",
27 "D[0o]cu?Send",
28 "d[0o]csign",
29 "D[0o]cu-eSin",
30 "D[0o]cu-management",
31 "\\beSign",
32 "e\\.sign",
33 "esign.[0o]nline",
34 "[SsZz][lL][GgSs][Nn].*D[0o]c",
35 "e-d[0o]c",
36 "e-signature",
37 "e-Verify Doc",
38 "eSignature",
39 "eSign&Return",
40 "eSign[0o]nline",
41 "Fileshare",
42 "Review.and.C[0o]mplete",
43 "Review.&.Sign",
44 "Sign[0o]nline",
45 "Signature.Request",
46 "Shared.C[0o]mpleted",
47 "Sign.and.Seal",
48 "viaSign",
49 "D[0o]cuSign",
50 "D[0o]csID",
51 "Complete.{0,10}D[0o]cuSign",
52 "Enroll & Sign",
53 "Review and Sign",
54 "Sign(?:Report|Now)",
55 "SignD[0o]c",
56 "D[0o]cxxx",
57 "d[0o]cufile",
58 'E\x{00AD}-\x{00AD}S\x{00AD}i\x{00AD}g\x{00AD}n\x{00AD}&Return',
59 "d[0o]cument.signature",
60 "Electr[0o]nic.?Signature",
61 "Complete: ",
62 "Please (?:Review|Sign)",
63 "^REVIEW$",
64 "requests your signature",
65 "signature on.*contract",
66 "Independent Contract",
67 "Contract.*signature",
68 "add your signature",
69 "signature needed",
70 "attn_task",
71 "DocReq\\b"
72 )
73 or (
74 regex.icontains(strings.replace_confusables(.), "action.re?quired")
75 and not (
76 sender.email.domain.root_domain == "sharepointonline.com"
77 and headers.auth_summary.dmarc.pass
78 and strings.icontains(subject.subject, "asked to edit")
79 )
80 )
81 )
82 // lure CTA injected into the body (not subject/display) above a forwarded thread
83 or (
84 regex.icontains(strings.replace_confusables(body.current_thread.text),
85 "requests? your signature",
86 "review, sign, and return",
87 "signature on the attached"
88 )
89 // legit "please sign & return" mail attaches the actual document; this
90 // campaign references an "attached" doc but delivers a fake one via an
91 // off-domain link, with no real document attached
92 and not any(attachments,
93 .file_extension in~ ("pdf", "doc", "docx", "xls", "xlsx", "rtf")
94 )
95 // legit notification platforms (e.g. ParentSquare, Panopto) self-host their
96 // "review/sign/view" CTA on the sender's own root domain; this campaign points
97 // the CTA at an off-domain credential page. require a suspicious link whose
98 // display text is a document CTA AND that leaves the sender domain, so
99 // self-hosted legit notifications (and incidental links like the aka.ms
100 // first-contact banner, which carries no CTA verb) don't match.
101 and any(body.links,
102 .href_url.domain.root_domain is not null
103 and .href_url.domain.root_domain != sender.email.domain.root_domain
104 and regex.icontains(strings.replace_confusables(.display_text),
105 "view",
106 "review",
107 "sign",
108 "document",
109 "download",
110 "open",
111 "complete"
112 )
113 )
114 )
115 )
116 and (
117 // unusual repeated patterns in HTML
118 regex.icontains(body.html.raw, '((<br\s*/?>\s*){20,}|\n{20,})')
119 or regex.icontains(body.html.raw, '(<p[^>]*>\s*<br\s*/?>\s*</p>\s*){30,}')
120 or regex.icontains(body.html.raw,
121 '(<p class=".*?"><span style=".*?"><o:p> </o:p></span></p>\s*){30,}'
122 )
123 or regex.icontains(body.html.raw, '(<p> </p>\s*){7,}')
124 or regex.icontains(body.html.raw, '(<p[^>]*>\s* <br>\s*</p>\s*){5,}')
125 or regex.icontains(body.html.raw, '(<p[^>]*> </p>\s*){7,}')
126 or strings.count(body.html.raw, " \u{200C} \u{200C} ") > 50
127 or regex.count(body.html.raw,
128 '<span\s*class\s*=\s*"[^\"]+"\s*>\s*[a-z]\s*<\/span><span\s*class\s*=\s*"[^\"]+"\s*>\s*[a-z]+\s*<\/span>'
129 ) > 50
130 // lookalike docusign
131 or regex.icontains(body.html.raw, '>Docus[1l]gn<')
132 or strings.icontains(body.current_thread.text, 'completed by all parties')
133 or (
134 regex.icontains(body.html.inner_text, 'Document')
135 and length(body.html.inner_text) < 500
136 )
137 // common greetings via email.local_part
138 or any(recipients.to,
139 // use count to ensure the email address is not part of a disclaimer
140 strings.icount(body.current_thread.text, .email.local_part) >
141 // sum allows us to add more logic as needed
142 sum([
143 strings.icount(body.current_thread.text,
144 strings.concat('was sent to ', .email.email)
145 ),
146 strings.icount(body.current_thread.text,
147 strings.concat('intended for ', .email.email)
148 )
149 ]
150 )
151 )
152 // common greetings via mailbox display name
153 or strings.icount(body.current_thread.text, mailbox.display_name) >
154 // sum allows us to add more logic as needed
155 sum([
156 strings.icount(body.current_thread.text,
157 strings.concat('was sent to ', mailbox.display_name)
158 ),
159 strings.icount(body.current_thread.text,
160 strings.concat('intended for ', mailbox.display_name)
161 )
162 ]
163 )
164 // Abnormally high count of mailto links in raw html
165 or regex.count(body.html.raw,
166 'mailto:[A-Za-z0-9._%+-]+@[A-Za-z0-9.-]+\.[A-Za-z]{2,}'
167 ) > 50
168
169 // High count of empty elements (padding)
170 or regex.count(body.html.raw,
171 '<(?:p|div|span|td)[^>]*>\s*(?: |\s)*\s*</(?:p|div|span|td)>'
172 ) > 30
173
174 // HR impersonation
175 or strings.ilike(sender.display_name, "HR", "H?R", "*Human Resources*")
176
177 // Sender display name contains a phone number
178 or regex.icontains(sender.display_name,
179 '\+?([ilo0-9]{1}.)?\(?[ilo0-9]{3}?\)?.[ilo0-9]{3}.?[ilo0-9]{4}'
180 )
181
182 // short CTA grafted above a forwarded legitimate thread to borrow its credibility
183 or (
184 length(body.previous_threads) > 0 and length(body.current_thread.text) < 600
185 )
186 )
187 and (
188 any(body.links,
189
190 // suspicious content within link display_text
191 regex.icontains(strings.replace_confusables(.display_text),
192 "activate",
193 "re-auth",
194 "verify",
195 "acknowledg",
196 "(keep|change).{0,20}(active|password|access)",
197 '((verify|view|click|download|goto|keep|Vιew|release).{0,15}(attachment|current|download|fax|file|document|message|same)s?)',
198 'use.same.pass',
199 'validate.{0,15}account',
200 'recover.{0,15}messages',
201 '(retry|update).{0,10}payment',
202 'check activity',
203 '(listen|play).{0,10}(vm|voice)',
204 'clarify.{0,20}(deposit|wallet|funds)',
205 'enter.{0,15}teams',
206 'Review and sign',
207 'REVIEW.*DOCUMENT',
208 'Open Document',
209 'Sign Now',
210 'complete tasks?'
211 )
212 // check that the display_text is all lowercase
213 or (
214 regex.contains(.display_text,
215 "\\bVIEW",
216 "DOWNLOAD",
217 "CHECK",
218 "KEEP.(SAME|MY)",
219 "VERIFY",
220 "ACCESS\\b",
221 "SIGN\\b",
222 "ENABLE\\b",
223 "RETAIN",
224 "PLAY",
225 "LISTEN",
226 )
227 and regex.match(.display_text, "^[^a-z]*[A-Z][^a-z]*$")
228 )
229
230 // the display text is _exactly_
231 or .display_text in~ ("Open")
232
233 // URL fragment containing recipient's address
234 or .href_url.fragment in map(recipients.to, .email.email)
235 )
236 // one hyperlinked image that's not a tracking pixel
237 or (
238 length(html.xpath(body.html,
239 "//a//img[(number(@width) > 5 or not(@width)) and (number(@height) > 5 or not(@height))]"
240 ).nodes
241 ) == 1
242 and length(body.current_thread.text) < 500
243 )
244 or (
245 length(attachments) > 0
246 and any(attachments,
247 (
248 regex.icontains(beta.ocr(.).text,
249 "activate",
250 "re-auth",
251 "verify",
252 "acknowledg",
253 "(keep|change).{0,20}(active|password|access)",
254 '((verify|view|click|download|goto|keep|Vιew|release).{0,15}(attachment|current|download|fax|file|document|message|same)s?)',
255 'use.same.pass',
256 'validate.{0,15}account',
257 'recover.{0,15}messages',
258 '(retry|update).{0,10}payment',
259 'check activity',
260 '(listen|play).{0,10}(vm|voice)',
261 'clarify.{0,20}(deposit|wallet|funds)',
262 'enter.{0,15}teams',
263 'Review and sign'
264 )
265 )
266 or (
267 any(file.explode(.),
268 regex.icontains(.scan.ocr.raw,
269 "activate",
270 "re-auth",
271 "verify",
272 "acknowledg",
273 "(keep|change).{0,20}(active|password|access)",
274 '((verify|view|click|download|goto|keep|Vιew|release).{0,15}(attachment|current|download|fax|file|document|message|same)s?)',
275 'use.same.pass',
276 'validate.{0,15}account',
277 'recover.{0,15}messages',
278 '(retry|update).{0,10}payment',
279 'check activity',
280 '(listen|play).{0,10}(vm|voice)',
281 'clarify.{0,20}(deposit|wallet|funds)',
282 'enter.{0,15}teams',
283 'Review and sign'
284 )
285 )
286 )
287 )
288 )
289 )
290 // the message is unsolicited and no false positives
291 and (
292 not profile.by_sender_email().solicited
293 or profile.by_sender_email().prevalence == "new"
294 or (
295 profile.by_sender_email().any_messages_malicious_or_spam
296 and not profile.by_sender_email().any_messages_benign
297 )
298 or (
299 profile.by_sender_email().any_messages_malicious_or_spam
300 and profile.by_sender_email().any_messages_benign
301 and (
302 not headers.auth_summary.dmarc.pass or not headers.auth_summary.spf.pass
303 )
304 )
305 )
306
307 // negate replies/fowards containing legitimate docs
308 and not (length(headers.references) > 0 or headers.in_reply_to is not null)
309
310 // negate highly trusted sender domains unless they fail DMARC authentication
311 and (
312 (
313 sender.email.domain.root_domain in $high_trust_sender_root_domains
314 and (
315 any(distinct(headers.hops, .authentication_results.dmarc is not null),
316 strings.ilike(.authentication_results.dmarc, "*fail")
317 )
318 )
319 )
320 or sender.email.domain.root_domain not in $high_trust_sender_root_domains
321 )
322attack_types:
323 - "Credential Phishing"
324tactics_and_techniques:
325 - "Social engineering"
326detection_methods:
327 - "Content analysis"
328 - "Header analysis"
329 - "HTML analysis"
330 - "URL analysis"
331 - "Sender analysis"
332id: "9b68c2d8-951e-5e04-9fa3-2ca67d9226a6"