Brand impersonation: Sedgwick Claims

calendar Aug 25, 2026  ·
Share on: linkedin copy

Detects inbound messages that impersonate Sedgwick Claims Management Services, either through a display name containing 'Sedgwick Claim' or through NLU classification identifying Sedgwick as an organization entity alongside high-confidence financial communication topics. Legitimate messages from verified Sedgwick domains (sedgwick.com or sedgwickcms.com) that pass DMARC authentication are excluded.

Sublime rule (View on GitHub)

 1name: "Brand impersonation: Sedgwick Claims"
 2description: "Detects inbound messages that impersonate Sedgwick Claims Management Services, either through a display name containing 'Sedgwick Claim' or through NLU classification identifying Sedgwick as an organization entity alongside high-confidence financial communication topics. Legitimate messages from verified Sedgwick domains (sedgwick.com or sedgwickcms.com) that pass DMARC authentication are excluded."
 3type: "rule"
 4severity: "medium"
 5source: |
 6  type.inbound
 7  and (
 8    strings.icontains(sender.display_name, "Sedgwick Claim")
 9    or (
10      any(ml.nlu_classifier(body.current_thread.text).entities,
11          .name == "sender" and .text == "Sedgwick"
12      )
13      and any(ml.nlu_classifier(body.current_thread.text).topics,
14              .name == "Financial Communications" and .confidence == "high"
15      )
16      and any(body.links, strings.icontains(.display_text, "claim"))
17    )
18  )
19  and not (
20    sender.email.domain.root_domain in ("sedgwick.com", "sedgwickcms.com")
21    and coalesce(headers.auth_summary.dmarc.pass, false)
22  )  
23attack_types:
24  - "BEC/Fraud"
25  - "Credential Phishing"
26tactics_and_techniques:
27  - "Impersonation: Brand"
28  - "Spoofing"
29  - "Social engineering"
30detection_methods:
31  - "Natural Language Understanding"
32  - "Sender analysis"
33  - "Header analysis"
34id: "e9f2c14d-bf70-5205-8cba-ccf04017904f"
to-top