Brand impersonation: Deloitte LLC domain in CC

calendar Sep 2, 2026  ·
Share on: linkedin copy

Flags inbound messages where a recipient in the CC field—either in the message itself or within a previous email thread included in the body—uses the deloittellc.com root domain. This can indicate an attempt to impersonate or leverage Deloitte's identity to add legitimacy to a message or exploit a hijacked thread.

Sublime rule (View on GitHub)

 1name: "Brand impersonation: Deloitte LLC domain in CC"
 2description: "Flags inbound messages where a recipient in the CC field—either in the message itself or within a previous email thread included in the body—uses the deloittellc.com root domain. This can indicate an attempt to impersonate or leverage Deloitte's identity to add legitimacy to a message or exploit a hijacked thread."
 3type: "rule"
 4severity: "high"
 5source: |
 6  type.inbound
 7  and (
 8    any(recipients.cc, .email.domain.root_domain == 'deloittellc.com')
 9    or any(body.previous_threads,
10           any(.recipients.cc, .email.domain.root_domain == 'deloittellc.com')
11    )
12  )  
13attack_types:
14  - "BEC/Fraud"
15tactics_and_techniques:
16  - "Impersonation: Brand"
17  - "Social engineering"
18detection_methods:
19  - "Header analysis"
20id: "372f5c7f-eb89-56c7-897b-1ec30bfb26d3"
to-top