Credential phishing: Personalized document signing request

 1name: "Credential phishing: Personalized document signing request"
 2description: "Detects messages with a single recipient and personalized document signing requests. The rule identifies messages referencing DocuSign or document-related language, combined with domain-specific greeting patterns or known malicious HTML artifacts associated with fraudulent signing invitations from entities such as STAR Capital or Agito AS."
 3type: "rule"
 4severity: "medium"
 5source: |
 6  type.inbound
 7  // personalized document form ensures recipients should always be 1
 8  and length(recipients.to) == 1
 9  and 2 of (
10    // document/sign language
11    strings.icontains(body.current_thread.text, 'docusign', 'document'),
12    // greeting uses recipient's email local_part
13    any(recipients.to,
14        strings.icontains(body.current_thread.text,
15                          strings.concat("You're receiving this on behalf of ",
16                                         .email.domain.sld
17                          )
18        )
19        or strings.icontains(body.current_thread.text,
20                             strings.concat("Invitation to sign document for ",
21                                            .email.domain.sld
22                             )
23        )
24    ),
25    // templated html artifact
26    strings.contains(body.html.raw,
27                     'STAR Capital invites you to exchange',
28                     'Reminder: Invitation to sign document for Agito AS'
29    )
30  )  
31attack_types:
32  - "Credential Phishing"
33  - "BEC/Fraud"
34tactics_and_techniques:
35  - "Impersonation: Brand"
36  - "Social engineering"
37detection_methods:
38  - "Content analysis"
39  - "HTML analysis"
40id: "367978c7-f850-571f-8b8f-7076ff6a9aca"