sublimemediumRule

Brand impersonation: Anthropic/Claude with newly registered domain

Detects messages impersonating Anthropic or Claude using sender display names of 'Anthropic' or 'Claude' from domains not affiliated with the legitimate brands. The rule flags messages where the sending domain, reply-to domain, or return-path domain is newly registered (under 90 days old).

MITRE ATT&CK

T1566.002 T1534 T1656 T1566 T1583.001 T1598

initial-access

Detection Query

type.inbound
and regex.icontains(sender.display_name, '(?:claude|anthropic)')
// sender display name with claude, anthropic - created less than 90 days
and network.whois(sender.email.domain).days_old <= 90

// common theme for suspicious claude, anthropic
and 2 of (
  strings.icontains(body.current_thread.text, "ad account"),
  strings.icontains(body.current_thread.text, "claude ads"),
  strings.icontains(body.current_thread.text, "trial access"),
  strings.icontains(body.current_thread.text, "subscription"),
  strings.icontains(body.current_thread.text, "workspace"),
  strings.icontains(body.current_thread.text, 'ads team'),
  strings.icontains(body.current_thread.text, 'google ads'),
  regex.icontains(body.current_thread.text, "connect.{0,30}account"),
  regex.icontains(body.current_thread.text, '\banthropic\s+(?:team|pbc)\b'),
  2 of (
    strings.icontains(body.current_thread.text, '548 Market Street'),
    strings.icontains(body.current_thread.text, 'San Francisco'),
    strings.icontains(body.current_thread.text, 'CA 94104')
  ),
  any(ml.nlu_classifier(body.current_thread.text).entities,
      .name == "sender"
      and strings.icontains(.text, "Claude", "Anthropic")
      and strings.iends_with(.text, "Team")
  )
)

// negate highly trusted sender domains unless they fail DMARC authentication
and not (
  sender.email.domain.root_domain in $high_trust_sender_root_domains
  and coalesce(headers.auth_summary.dmarc.pass, false)
)

Data Sources

Email MessagesEmail HeadersEmail Attachments

Platforms

Raw Content

name: "Brand impersonation: Anthropic/Claude with newly registered domain"
description: "Detects messages impersonating Anthropic or Claude using sender display names of 'Anthropic' or 'Claude' from domains not affiliated with the legitimate brands. The rule flags messages where the sending domain, reply-to domain, or return-path domain is newly registered (under 90 days old)."
type: "rule"
severity: "medium"
source: |
  type.inbound
  and regex.icontains(sender.display_name, '(?:claude|anthropic)')
  // sender display name with claude, anthropic - created less than 90 days
  and network.whois(sender.email.domain).days_old <= 90
  
  // common theme for suspicious claude, anthropic
  and 2 of (
    strings.icontains(body.current_thread.text, "ad account"),
    strings.icontains(body.current_thread.text, "claude ads"),
    strings.icontains(body.current_thread.text, "trial access"),
    strings.icontains(body.current_thread.text, "subscription"),
    strings.icontains(body.current_thread.text, "workspace"),
    strings.icontains(body.current_thread.text, 'ads team'),
    strings.icontains(body.current_thread.text, 'google ads'),
    regex.icontains(body.current_thread.text, "connect.{0,30}account"),
    regex.icontains(body.current_thread.text, '\banthropic\s+(?:team|pbc)\b'),
    2 of (
      strings.icontains(body.current_thread.text, '548 Market Street'),
      strings.icontains(body.current_thread.text, 'San Francisco'),
      strings.icontains(body.current_thread.text, 'CA 94104')
    ),
    any(ml.nlu_classifier(body.current_thread.text).entities,
        .name == "sender"
        and strings.icontains(.text, "Claude", "Anthropic")
        and strings.iends_with(.text, "Team")
    )
  )
  
  // negate highly trusted sender domains unless they fail DMARC authentication
  and not (
    sender.email.domain.root_domain in $high_trust_sender_root_domains
    and coalesce(headers.auth_summary.dmarc.pass, false)
  )
attack_types:
  - "BEC/Fraud"
  - "Spam"
tactics_and_techniques:
  - "Lookalike domain"
  - "Social engineering"
  - "Spoofing"
detection_methods:
  - "Content analysis"
  - "Header analysis"
  - "Sender analysis"
  - "Whois"
id: "02d16c54-a773-5286-b7a8-7b37551ccba5"