Brand impersonation: MyChart

calendar Sep 4, 2026  ·
Share on: linkedin copy

Detects inbound messages impersonating MyChart, the patient portal brand, by using a display name containing 'mychart' combined with common lure phrases such as 'claim your reward', 'member rewards', 'feedback survey', or 'medicare kit'. The rule also flags messages sent from recently registered domains. Legitimate senders from trusted MyChart-related domains that pass DMARC authentication, as well as designated high-trust sender domains, are excluded.

Sublime rule (View on GitHub)

 1name: "Brand impersonation: MyChart"
 2description: "Detects inbound messages impersonating MyChart, the patient portal brand, by using a display name containing 'mychart' combined with common lure phrases such as 'claim your reward', 'member rewards', 'feedback survey', or 'medicare kit'. The rule also flags messages sent from recently registered domains. Legitimate senders from trusted MyChart-related domains that pass DMARC authentication, as well as designated high-trust sender domains, are excluded."
 3type: "rule"
 4severity: "medium"
 5source: |
 6  type.inbound
 7  and (
 8    strings.icontains(sender.display_name, "mychart")
 9    or any(ml.nlu_classifier(body.current_thread.text).entities,
10           .name == "org" and strings.icontains(.text, 'mychart medicare kit')
11    )
12  )
13  and (
14    (
15      strings.icontains(body.current_thread.text, "mychart")
16      and 2 of (
17        strings.icontains(body.current_thread.text, "claim your reward"),
18        strings.icontains(body.current_thread.text, "feedback survey"),
19        strings.icontains(body.current_thread.text, "invited to participate"),
20        strings.icontains(body.current_thread.text, "medicare kit"),
21        strings.icontains(body.current_thread.text, "member rewards"),
22        strings.icontains(body.current_thread.text, "member appreciation"),
23        strings.icontains(body.current_thread.text, "log in to mychart"),
24        regex.icontains(body.current_thread.text, '©\s*(?:\d+)\s*mychart')
25      )
26    )
27    or strings.icontains(subject.base, "medicare kit")
28    or network.whois(sender.email.domain).days_old < 365
29  )
30  and not (
31    sender.email.domain.root_domain in (
32      "epic-notification.com",
33      "myhealthconnect.org"
34    )
35    and coalesce(headers.auth_summary.dmarc.pass, false)
36  )
37  // negate highly trusted sender domains unless they fail DMARC authentication
38  and not (
39    sender.email.domain.root_domain in $high_trust_sender_root_domains
40    and coalesce(headers.auth_summary.dmarc.pass, false)
41  )  
42attack_types:
43  - "Credential Phishing"
44  - "Spam"
45tactics_and_techniques:
46  - "Impersonation: Brand"
47  - "Social engineering"
48  - "Spoofing"
49detection_methods:
50  - "Content analysis"
51  - "Natural Language Understanding"
52  - "Header analysis"
53  - "Sender analysis"
54id: "8be6743d-8d17-53ef-97c7-cb00f2b27374"
to-top