Sync from PR#2044

Create abuse_docusign_unsolicited_reply-to.yml by @zoomequipd
#2044
Source SHA b88469d
Triggered by @zoomequipd

detection-rules/abuse_docusign_unsolicited_reply-to.yml

@@ -2,7 +2,7 @@ name: "Service Abuse: DocuSign Share From an Unsolicited Reply-To Address"
 description: "DocuSign shares which contain a reply-to address or domain that has not been previously observed by the recipient organization."
 type: "rule"
 severity: "high"
-source: "type.inbound\n\n// message is from docusign actual\nand sender.email.domain.root_domain == 'docusign.net'\nand (headers.auth_summary.spf.pass or headers.auth_summary.dmarc.pass)\n\n\n// not a completed DocuSign\n// reminders are sent automatically and can be just as malicious as the initial\n// users often decline malicious ones\nand not strings.istarts_with(subject.subject, \"Completed:\")\n\nand length(headers.reply_to) > 0 \n// reply-to email address has never been sent an email by the org\nand not (\n  any(headers.reply_to, .email.email in $recipient_emails)\n  // if the reply-to email address is NOT in free_email_providers, check the domain in recipient_domains\n  or any(filter(headers.reply_to,\n                // filter the list to only emails that are not in free_email_providers\n                (\n                  .email.domain.domain not in $free_email_providers\n                  or .email.domain.root_domain not in $free_email_providers\n                )\n         ),\n         .email.domain.domain in $recipient_domains\n  )\n)\n// reply-to address has never sent an email to the org\nand not (\n  any(headers.reply_to, .email.email in $sender_emails)\n  // if the reply-to address is NOT in free_email_providers, check the domain in sender_domains\n  or any(filter(headers.reply_to,\n                // filter the list to only emails that are not in free_email_providers\n                (\n                  .email.domain.domain not in $free_email_providers\n                  or .email.domain.domain not in $free_email_providers\n                )\n         ),\n         .email.domain.root_domain in $sender_domains\n  )\n)\n"
+source: "type.inbound\n\n// message is from docusign actual\nand sender.email.domain.root_domain == 'docusign.net'\nand (headers.auth_summary.spf.pass or headers.auth_summary.dmarc.pass)\n\n\n// not a completed DocuSign\n// reminders are sent automatically and can be just as malicious as the initial\n// users often decline malicious ones\nand not strings.istarts_with(subject.subject, \"Completed: \")\nand not strings.istarts_with(subject.subject, \"Here is your signed document: \")\nand not strings.istarts_with(subject.subject, \"Voided: \")\n\nand length(headers.reply_to) > 0 \n// reply-to email address has never been sent an email by the org\nand not (\n  any(headers.reply_to, .email.email in $recipient_emails)\n  // if the reply-to email address is NOT in free_email_providers, check the domain in recipient_domains\n  or any(filter(headers.reply_to,\n                // filter the list to only emails that are not in free_email_providers\n                (\n                  .email.domain.domain not in $free_email_providers\n                  or .email.domain.root_domain not in $free_email_providers\n                )\n         ),\n         .email.domain.domain in $recipient_domains\n  )\n)\n// reply-to address has never sent an email to the org\nand not (\n  any(headers.reply_to, .email.email in $sender_emails)\n  // if the reply-to address is NOT in free_email_providers, check the domain in sender_domains\n  or any(filter(headers.reply_to,\n                // filter the list to only emails that are not in free_email_providers\n                (\n                  .email.domain.domain not in $free_email_providers\n                  or .email.domain.domain not in $free_email_providers\n                )\n         ),\n         .email.domain.root_domain in $sender_domains\n  )\n)\n"
 attack_types:
   - "Credential Phishing"
 tactics_and_techniques:
@@ -15,4 +15,4 @@ detection_methods:
   - "Sender analysis"
 id: "2f12d616-f47a-5259-8946-ac2e01940f6f"
 testing_pr: 2044
-testing_sha: 481d3d4e2f6179b6bd6eadcc877e7220b26c4ae9
+testing_sha: b88469d25b5b5af074562b3d1d27c56a8a0909ff