Sync from PR#2082

Update credential_phishing_esign_document_notification.yml by @zoomequipd
#2082
Source SHA 0b5f712
Triggered by @zoomequipd

detection-rules/credential_phishing_esign_document_notification.yml

@@ -0,0 +1,18 @@
+name: "Credential Phishing: Suspicious E-sign Agreement Document Notification"
+description: "Detects phishing attempts disguised as e-signature requests, characterized by common document sharing phrases, unusual HTML padding, and suspicious link text."
+type: "rule"
+severity: "medium"
+source: "type.inbound\nand any([subject.subject, sender.display_name],\n        regex.icontains(strings.replace_confusables(.),\n                        \"DocuLink\",\n                        \"Access.&.Approved\",\n                        \"Agreement.{0,5}Review\",\n                        \"Attend.and.Review\",\n                        \"Completed.File\",\n                        \"Dochsared\",\n                        \"Docshared\",\n                        \"DocsPoint\",\n                        \"Document.Shared\",\n                        \"DocuCentre\",\n                        \"DocuCenter\",\n                        \"DocCenter\",\n                        \"DocsOnline\",\n                        \"DocSend\",\n                        \"\\\\beSign\",\n                        \"e\\\\.sign\",\n                        \"esign.online\",\n                        \"e-doc\",\n                        \"e-signature\",\n                        \"eSignature\",\n                        \"eSign&Return\",\n                        \"eSignOnline\",\n                        \"Fileshare\",\n                        \"Review.and.Complete\",\n                        \"Review.&.Sign\",\n                        \"SignOnline\",\n                        \"Signature.Request\",\n                        \"Shared.Completed\",\n                        \"Sign.and.Seal\",\n                        \"viaSign\",\n                        \"D0cuSign\",\n                        \"DocsID\",\n                        \"Complete.{0,10}DocuSign\",\n                        \"Enroll & Sign\",\n                        \"Review and Sign\",\n                        \"SignReport\",\n                        \"SignDoc\",\n                        \"Docxxx\",\n                        \"docufile\",\n                        \"E­-­S­i­g­n­&Return\",\n                        \"document.signature\",\n                        \"Electronic.?Signature\"\n        )\n)\nand (\n  // unusual repeated patterns in HTML \n  regex.icontains(body.html.raw, '((<br\\s*/?>\\s*){20,}|\\n{20,})')\n  or regex.icontains(body.html.raw, '(<p[^>]*>\\s*<br\\s*/?>\\s*</p>\\s*){30,}')\n  or regex.icontains(body.html.raw,\n                     '(<p class=\".*?\"><span style=\".*?\"><o:p>&nbsp;</o:p></span></p>\\s*){30,}'\n  )\n  or regex.icontains(body.html.raw, '(<p>&nbsp;</p>\\s*){7,}')\n  or regex.icontains(body.html.raw, '(<p[^>]*>\\s*&nbsp;<br>\\s*</p>\\s*){5,}')\n  or regex.icontains(body.html.raw, '(<p[^>]*>&nbsp;</p>\\s*){7,}')\n  or strings.count(body.html.raw, '&nbsp;‌&nbsp;‌&nbsp') > 50\n  or regex.count(body.html.raw,\n                 '<span\\s*class\\s*=\\s*\"[^\\\"]+\"\\s*>\\s*[a-z]\\s*<\\/span><span\\s*class\\s*=\\s*\"[^\\\"]+\"\\s*>\\s*[a-z]+\\s*<\\/span>'\n  ) > 50\n  // lookalike docusign\n  or regex.icontains(body.html.raw, '>Docus[1l]gn<')\n  or (regex.icontains(body.html.inner_text, 'Document') and length(body.html.inner_text) < 300)\n  // common greetings via email.local_part\n  or any(recipients.to,\n         strings.icontains(body.current_thread.text, .email.local_part)\n  )\n  // HR impersonation\n  or strings.ilike(sender.display_name, \"HR\", \"H?R\", \"*Human Resources*\")\n)\nand (\n  any(body.links,\n      regex.icontains(.display_text,\n                      \"activate\",\n                      \"re-auth\",\n                      \"verify\",\n                      \"acknowledg\",\n                      \"(keep|change).{0,20}(active|password|access)\",\n                      '((verify|view|click|download|goto|keep|Vιew|release).{0,15}(attachment|current|download|fax|file|document|message|same)s?)',\n                      'use.same.pass',\n                      'validate.{0,15}account',\n                      'recover.{0,15}messages',\n                      '(retry|update).{0,10}payment',\n                      'check activity',\n                      '(listen|play).{0,10}(vm|voice)',\n                      'clarify.{0,20}(deposit|wallet|funds)',\n                      'enter.{0,15}teams',\n                      'Review and sign'\n      )\n  )\n  or any(body.links,\n         (\n           regex.contains(.display_text,\n                          \"\\\\bVIEW\",\n                          \"DOWNLOAD\",\n                          \"CHECK\",\n                          \"KEEP.(SAME|MY)\",\n                          \"VERIFY\",\n                          \"ACCESS\\\\b\",\n                          \"SIGN\\\\b\",\n                          \"ENABLE\\\\b\",\n                          \"RETAIN\",\n                          \"PLAY\",\n                          \"LISTEN\",\n           )\n           and regex.match(.display_text, \"^[^a-z]*[A-Z][^a-z]*$\")\n         )\n  )\n  or (\n    length(attachments) > 0\n    and any(attachments,\n            (\n              regex.icontains(beta.ocr(.).text,\n                              \"activate\",\n                              \"re-auth\",\n                              \"verify\",\n                              \"acknowledg\",\n                              \"(keep|change).{0,20}(active|password|access)\",\n                              '((verify|view|click|download|goto|keep|Vιew|release).{0,15}(attachment|current|download|fax|file|document|message|same)s?)',\n                              'use.same.pass',\n                              'validate.{0,15}account',\n                              'recover.{0,15}messages',\n                              '(retry|update).{0,10}payment',\n                              'check activity',\n                              '(listen|play).{0,10}(vm|voice)',\n                              'clarify.{0,20}(deposit|wallet|funds)',\n                              'enter.{0,15}teams',\n                              'Review and sign'\n              )\n            )\n            or (\n              any(file.explode(.),\n                  regex.icontains(.scan.ocr.raw,\n                                  \"activate\",\n                                  \"re-auth\",\n                                  \"verify\",\n                                  \"acknowledg\",\n                                  \"(keep|change).{0,20}(active|password|access)\",\n                                  '((verify|view|click|download|goto|keep|Vιew|release).{0,15}(attachment|current|download|fax|file|document|message|same)s?)',\n                                  'use.same.pass',\n                                  'validate.{0,15}account',\n                                  'recover.{0,15}messages',\n                                  '(retry|update).{0,10}payment',\n                                  'check activity',\n                                  '(listen|play).{0,10}(vm|voice)',\n                                  'clarify.{0,20}(deposit|wallet|funds)',\n                                  'enter.{0,15}teams',\n                                  'Review and sign'\n                  )\n              )\n            )\n    )\n  )\n)\nand (\n  not profile.by_sender().solicited\n  or (\n    profile.by_sender().any_messages_malicious_or_spam\n    and not profile.by_sender().any_false_positives\n  )\n)\nand not profile.by_sender().any_false_positives\n\n// negate replies/fowards containing legitimate docs\nand not (\n  length(headers.references) > 0\n  or any(headers.hops, any(.fields, strings.ilike(.name, \"In-Reply-To\")))\n)\n\n// negate highly trusted sender domains unless they fail DMARC authentication\nand (\n  (\n    sender.email.domain.root_domain in $high_trust_sender_root_domains\n    and (\n      any(distinct(headers.hops, .authentication_results.dmarc is not null),\n          strings.ilike(.authentication_results.dmarc, \"*fail\")\n      )\n    )\n  )\n  or sender.email.domain.root_domain not in $high_trust_sender_root_domains\n)\n"
+attack_types:
+  - "Credential Phishing"
+tactics_and_techniques:
+  - "Social engineering"
+detection_methods:
+  - "Content analysis"
+  - "Header analysis"
+  - "HTML analysis"
+  - "URL analysis"
+  - "Sender analysis"
+id: "9b68c2d8-951e-5e04-9fa3-2ca67d9226a6"
+testing_pr: 2082
+testing_sha: 0b5f712d31f571207e3fc10595cc7c4a28f4e1f6