Sync from PR#832

New Rule: Callback Phishing via DocuSign comment by @morriscode
#832
Source SHA eb29e5b
Triggered by @morriscode

detection-rules/callback_phishing_docusign_comment.yml

@@ -0,0 +1,21 @@
+name: "Callback Phishing via DocuSign comment"
+description: "This rule inspects messages originating from legitimate DocuSign infrastructure, with a DocuSign logo that match Callback Phishing criteria, in the body, requiring at least one brand name, as well as 3 matching Callback Phishing terms and a phone number. \n"
+type: "rule"
+severity: "medium"
+source: "type.inbound\nand length(attachments) == 0\n\n// Legitimate Docusign sending infratructure\nand (\n    sender.email.domain.root_domain in ('docusign.net', 'docusign.com')\n  // check for DMARC fail for spoofs\n    and any(distinct(headers.hops, .authentication_results.dmarc is not null),\n            strings.ilike(.authentication_results.dmarc, \"pass\")\n    )\n  )\n\n// Docusign Logo \nand any(ml.logo_detect(beta.message_screenshot()).brands, .name == \"DocuSign\")\n\n// Callback Phishing\nand strings.ilike(body.current_thread.text,\n                  \"*mcafee*\",\n                  \"*norton*\",\n                  \"*geek squad*\",\n                  \"*paypal*\",\n                  \"*ebay*\",\n                  \"*symantec*\",\n                  \"*best buy*\",\n                  \"*lifelock*\"\n)\n\nand 3 of (\n  strings.ilike(body.current_thread.text, '*purchase*'),\n  strings.ilike(body.current_thread.text, '*payment*'),\n  strings.ilike(body.current_thread.text, '*transaction*'),\n  strings.ilike(body.current_thread.text, '*subscription*'),\n  strings.ilike(body.current_thread.text, '*antivirus*'),\n  strings.ilike(body.current_thread.text, '*order*'),\n  strings.ilike(body.current_thread.text, '*support*'),\n  strings.ilike(body.current_thread.text, '*help line*'),\n  strings.ilike(body.current_thread.text, '*receipt*'),\n  strings.ilike(body.current_thread.text, '*invoice*'),\n  strings.ilike(body.current_thread.text, '*call*'),\n  strings.ilike(body.current_thread.text, '*cancel*'),\n  strings.ilike(body.current_thread.text, '*renew*'),\n  strings.ilike(body.current_thread.text, '*refund*')\n)\n// phone number regex\nand regex.icontains(body.current_thread.text, '\\+?(\\d{1}.)?\\(?\\d{3}?\\)?.\\d{3}.?\\d{4}')\n"
+attack_types:
+  - "Callback Phishing"
+tactics_and_techniques:
+  - "Evasion"
+  - "Impersonation: Brand"
+  - "Out of band pivot"
+  - "Social engineering"
+detection_methods:
+  - "Content analysis"
+  - "Computer Vision"
+  - "Header analysis"
+  - "Sender analysis"
+  - "URL analysis"
+id: "48aec918-d1bb-511e-8eba-8c34a663f28c"
+testing_pr: 832
+testing_sha: eb29e5b332123a9b421166def74e8f128a4c8062