HR Impersonation via E-sign Agreement Comment

 1name: "HR Impersonation via E-sign Agreement Comment"
 2description: "This rule inspects messages originating from legitimate e-signature platform infrastructure, with engaging language in the body that matches HR Impersonation criteria."
 3type: "rule"
 4severity: "high"
 5source: |
 6  type.inbound
 7  and length(attachments) == 0
 8  
 9  // Legitimate Docusign sending infratructure
10  and (
11    sender.email.domain.root_domain in (
12      'docusign.net',
13      'docusign.com',
14      'hellosign.com'
15    )
16    // docusing.com as a reply-to is used in updates to documents, such as views, signs, etc
17    and not any(headers.reply_to, .email.domain.domain == 'docusign.com')
18    // check for SPF or DMARC passed
19    and (headers.auth_summary.spf.pass or headers.auth_summary.dmarc.pass)
20  )
21  
22  // HR Impersonation in body
23  and regex.icontains(body.current_thread.text,
24                      (
25                        '(\bh\W?r\W?\b|human\s?resources|hr depart(ment)?|employee relations)'
26                      )
27  )
28  
29  // Request and Urgency
30  and (
31    any(ml.nlu_classifier(body.current_thread.text).entities, .name == "request")
32    and (
33      any(ml.nlu_classifier(body.current_thread.text).intents,
34          .name == "cred_theft" and .confidence == "high"
35      )
36      or any(ml.nlu_classifier(body.current_thread.text).entities,
37             .name in ("urgency", "financial")
38      )
39    )
40  )
41  and (
42    any(ml.nlu_classifier(body.current_thread.text).intents, .name != "benign")
43    or length(ml.nlu_classifier(body.current_thread.text).intents) == 0 // not benign but not malicious either
44  )
45  
46  // Negate legitimate HR docusigns originating from within the org
47  and not (all(headers.reply_to, .email.domain.root_domain in $org_domains))
48  
49  // Negate replies
50  and (
51    length(headers.references) == 0
52    or not any(headers.hops, any(.fields, strings.ilike(.name, "In-Reply-To")))
53  )  
54
55attack_types:
56  - "BEC/Fraud"
57  - "Credential Phishing"
58tactics_and_techniques:
59  - "Evasion"
60  - "Impersonation: Brand"
61  - "Out of band pivot"
62  - "Social engineering"
63detection_methods:
64  - "Content analysis"
65  - "Header analysis"
66  - "Natural Language Understanding"
67  - "Sender analysis"
68id: "796c6f0f-7571-5b87-b53e-97948e8be474"