Brand impersonation: Anthropic/Claude with newly registered domain

 1name: "Brand impersonation: Anthropic/Claude with newly registered domain"
 2description: "Detects messages impersonating Anthropic or Claude using sender display names of 'Anthropic' or 'Claude' from domains not affiliated with the legitimate brands. The rule flags messages where the sending domain, reply-to domain, or return-path domain is newly registered (under 90 days old)."
 3type: "rule"
 4severity: "medium"
 5source: |
 6  type.inbound
 7  and regex.icontains(sender.display_name, '(?:claude|anthropic)')
 8  // sender display name with claude, anthropic - created less than 90 days
 9  and network.whois(sender.email.domain).days_old <= 90
10  
11  // common theme for suspicious claude, anthropic
12  and 2 of (
13    strings.icontains(body.current_thread.text, "ad account"),
14    strings.icontains(body.current_thread.text, "claude ads"),
15    strings.icontains(body.current_thread.text, "trial access"),
16    strings.icontains(body.current_thread.text, "subscription"),
17    strings.icontains(body.current_thread.text, "workspace"),
18    strings.icontains(body.current_thread.text, 'ads team'),
19    strings.icontains(body.current_thread.text, 'google ads'),
20    regex.icontains(body.current_thread.text, "connect.{0,30}account"),
21    regex.icontains(body.current_thread.text, '\banthropic\s+(?:team|pbc)\b'),
22    2 of (
23      strings.icontains(body.current_thread.text, '548 Market Street'),
24      strings.icontains(body.current_thread.text, 'San Francisco'),
25      strings.icontains(body.current_thread.text, 'CA 94104')
26    ),
27    any(ml.nlu_classifier(body.current_thread.text).entities,
28        .name == "sender"
29        and strings.icontains(.text, "Claude", "Anthropic")
30        and strings.iends_with(.text, "Team")
31    )
32  )
33  
34  // negate highly trusted sender domains unless they fail DMARC authentication
35  and not (
36    sender.email.domain.root_domain in $high_trust_sender_root_domains
37    and coalesce(headers.auth_summary.dmarc.pass, false)
38  )  
39attack_types:
40  - "BEC/Fraud"
41  - "Spam"
42tactics_and_techniques:
43  - "Lookalike domain"
44  - "Social engineering"
45  - "Spoofing"
46detection_methods:
47  - "Content analysis"
48  - "Header analysis"
49  - "Sender analysis"
50  - "Whois"
51id: "02d16c54-a773-5286-b7a8-7b37551ccba5"