High Severity
Brand Impersonation: DocuSign pdf attachment with suspicious link
Description
This rule detects DocuSign logos within PDF's that do not link to reputable domains, nor docusign themselves. This is typically indicative of Credential Phishing.
References
No references.
Sublime Security
Created Feb 3rd, 2025 • Last updated Feb 3rd, 2025
Feed Source
Sublime Core Feed
Source
type.inbound
and any(attachments,
.file_type == "pdf"
and any(ml.logo_detect(.).brands, .name == "DocuSign")
and any(file.explode(.),
length(.scan.url.urls) <=9
and any(.scan.url.urls,
.domain.root_domain not in $tranco_1m
and .domain.root_domain not in $org_domains
and .domain.root_domain != "sublimesecurity.com"
and not strings.ilike(.domain.root_domain, "docusign.*")
)
and any(ml.nlu_classifier(.scan.ocr.raw).entities,
.name == "org" and .text == "DocuSign"
)
and any(ml.nlu_classifier(.scan.ocr.raw).entities,
.name == "request"
)
)
)
Playground
Test against your own EMLs or sample data.