Brand impersonation: ConstructConnect

calendar Oct 6, 2026  ·
Share on: linkedin copy

Detects links impersonating the ConstructConnect platform. The rule identifies suspicious links from non-legitimate domains that load ConstructConnect logo assets, suggesting the sender is spoofing the platform to appear legitimate.

Sublime rule (View on GitHub)

 1name: "Brand impersonation: ConstructConnect"
 2description: "Detects links impersonating the ConstructConnect platform. The rule identifies suspicious links from non-legitimate domains that load ConstructConnect logo assets, suggesting the sender is spoofing the platform to appear legitimate."
 3type: "rule"
 4severity: "high"
 5source: |
 6  type.inbound
 7  // self sender or invalid recipient domain
 8  and length(recipients.to) == 1
 9  and (
10    sender.email.email == recipients.to[0].email.email
11    or recipients.to[0].email.domain.valid == false
12  )
13  and 0 < length(body.current_thread.links) < 10
14  and any(body.current_thread.links,
15          .href_url.domain.root_domain != 'constructconnect.com'
16          and any(ml.link_analysis(., mode="aggressive").unique_urls_accessed,
17                  .domain.root_domain == 'constructconnect.com'
18                  and strings.icontains(.path, 'logo', 'favicon.ico')
19          )
20  )  
21attack_types:
22  - "Credential Phishing"
23tactics_and_techniques:
24  - "Impersonation: Brand"
25  - "Spoofing"
26  - "Social engineering"
27detection_methods:
28  - "Sender analysis"
29  - "URL analysis"
30id: "1a088f99-e9a9-5ec5-a64e-84399a5c1eb9"
to-top