Sublime Security high experimental mql

Service abuse: DocSend share from newly registered domain

This Attack Surface Reduction (ASR) rule matches on DocSend notifications with recently registered reply-to domains.

View Source

Detection Logic

type.inbound

// Legitimate DocSend sending infratructure
and sender.email.email == "no-reply@docsend.com"
and headers.auth_summary.spf.pass
and headers.auth_summary.dmarc.pass

// the message needs to have a reply-to address
and length(headers.reply_to) > 0

// reply-to email address has never received an email from your org
and not any(headers.reply_to, .email.email in $recipient_emails)

// new reply-to
and any(headers.reply_to, network.whois(.email.domain).days_old < 30)

Field Validations

Loading…

Comments (0)

Loading comments...