Brand impersonation: Federal court system

calendar Oct 26, 2026  ·
Share on: linkedin copy

Detects inbound messages impersonating U.S. federal courts or related judiciary services (e.g., PACER, jury summons, clerk of court, Federal Rules of Civil Procedure) that attempt credential theft. The rule combines NLU-based detection of court/sender entities with credential-theft intent, or matches on multiple suspicious keywords/phrases commonly used in these notices. Legitimate newsletters are excluded, as are genuine .gov senders and highly trusted domains that pass DMARC authentication.

Sublime rule (View on GitHub)

 1name: "Brand impersonation: Federal court system"
 2description: "Detects inbound messages impersonating U.S. federal courts or related judiciary services (e.g., PACER, jury summons, clerk of court, Federal Rules of Civil Procedure) that attempt credential theft. The rule combines NLU-based detection of court/sender entities with credential-theft intent, or matches on multiple suspicious keywords/phrases commonly used in these notices. Legitimate newsletters are excluded, as are genuine .gov senders and highly trusted domains that pass DMARC authentication."
 3type: "rule"
 4severity: "medium"
 5source: |
 6  type.inbound
 7  and (
 8    (
 9      any(ml.nlu_classifier(body.current_thread.text).entities,
10          .name == "sender"
11          and regex.icontains(.text,
12                              '(?:U\.?S\.?|United States)\s*(?:District\s+)?Courts?\b'
13          )
14      )
15      and any(ml.nlu_classifier(body.current_thread.text).intents,
16              .name == "cred_theft" and .confidence != "low"
17      )
18    )
19    or 2 of (
20      strings.icontains(body.current_thread.text, "PACER"),
21      // real PACER Service Center phone number
22      strings.icontains(body.current_thread.text, "1-800-676-6856"),
23      strings.icontains(body.current_thread.text, "contempt charges"),
24      strings.icontains(body.current_thread.text, "Official Court Notice"),
25      regex.icontains(body.current_thread.text, '(?:jury summons|juror number)'),
26      strings.icontains(body.current_thread.text,
27                        'complaint has been filed against you'
28      )
29    )
30  )
31  and not any(ml.nlu_classifier(body.current_thread.text).topics,
32              .name == "Newsletters and Digests" and .confidence == "high"
33  )
34  // negate the actual federal judiciary unless it fails DMARC authentication
35  and not (
36    sender.email.domain.tld == "gov"
37    and coalesce(headers.auth_summary.dmarc.pass, false)
38  )
39  // negate highly trusted sender domains unless they fail DMARC authentication
40  and not (
41    sender.email.domain.root_domain in $high_trust_sender_root_domains
42    and coalesce(headers.auth_summary.dmarc.pass, false)
43  )  
44attack_types:
45  - "Credential Phishing"
46tactics_and_techniques:
47  - "Impersonation: Brand"
48  - "Social engineering"
49  - "Spoofing"
50detection_methods:
51  - "Natural Language Understanding"
52  - "Content analysis"
53  - "Header analysis"
54  - "Sender analysis"
55id: "f0bcf670-2665-5af2-a7a5-a8315e3e602e"
to-top