Brand impersonation: MyChart

calendar Aug 28, 2026  ·
Share on: linkedin copy

Detects inbound messages impersonating MyChart, the patient portal brand, by using a display name containing 'mychart' combined with common lure phrases such as 'claim your reward', 'member rewards', 'feedback survey', or 'medicare kit'. The rule also flags messages sent from recently registered domains. Legitimate senders from trusted MyChart-related domains that pass DMARC authentication, as well as designated high-trust sender domains, are excluded.

Sublime rule (View on GitHub)

 1name: "Brand impersonation: MyChart"
 2description: "Detects inbound messages impersonating MyChart, the patient portal brand, by using a display name containing 'mychart' combined with common lure phrases such as 'claim your reward', 'member rewards', 'feedback survey', or 'medicare kit'. The rule also flags messages sent from recently registered domains. Legitimate senders from trusted MyChart-related domains that pass DMARC authentication, as well as designated high-trust sender domains, are excluded."
 3type: "rule"
 4severity: "medium"
 5source: |
 6  type.inbound
 7  and strings.icontains(sender.display_name, "mychart")
 8  and (
 9    (
10      strings.icontains(body.current_thread.text, "mychart")
11      and 2 of (
12        strings.icontains(body.current_thread.text, "claim your reward"),
13        strings.icontains(body.current_thread.text, "feedback survey"),
14        strings.icontains(body.current_thread.text, "invited to participate"),
15        strings.icontains(body.current_thread.text, "medicare kit"),
16        strings.icontains(body.current_thread.text, "member rewards"),
17        strings.icontains(body.current_thread.text, "member appreciation"),
18        strings.icontains(body.current_thread.text, "log in to mychart"),
19        regex.icontains(body.current_thread.text, '©\s*(?:\d+)\s*mychart')
20      )
21    )
22    or strings.icontains(subject.base, "medicare kit")
23    or network.whois(sender.email.domain).days_old < 365
24  )
25  and not (
26    sender.email.domain.root_domain in (
27      "epic-notification.com",
28      "myhealthconnect.org"
29    )
30    and coalesce(headers.auth_summary.dmarc.pass, false)
31  )
32  // negate highly trusted sender domains unless they fail DMARC authentication
33  and not (
34    sender.email.domain.root_domain in $high_trust_sender_root_domains
35    and coalesce(headers.auth_summary.dmarc.pass, false)
36  )  
37attack_types:
38  - "Credential Phishing"
39  - "Spam"
40tactics_and_techniques:
41  - "Impersonation: Brand"
42  - "Social engineering"
43  - "Spoofing"
44detection_methods:
45  - "Content analysis"
46  - "Natural Language Understanding"
47  - "Header analysis"
48  - "Sender analysis"
49id: "8be6743d-8d17-53ef-97c7-cb00f2b27374"
to-top