sublimemediumRule

Brand impersonation: Sedgwick Claims

Detects inbound messages that impersonate Sedgwick Claims Management Services, either through a display name containing 'Sedgwick Claim' or through NLU classification identifying Sedgwick as an organization entity alongside high-confidence financial communication topics. Legitimate messages from verified Sedgwick domains (sedgwick.com or sedgwickcms.com) that pass DMARC authentication are excluded.

MITRE ATT&CK

T1566.002 T1534 T1656 T1566 T1566.001 T1598 T1598.003

initial-access

Detection Query

type.inbound
and (
  strings.icontains(sender.display_name, "Sedgwick Claim")
  or (
    any(ml.nlu_classifier(body.current_thread.text).entities,
        .name == "sender" and .text == "Sedgwick"
    )
    and any(ml.nlu_classifier(body.current_thread.text).topics,
            .name == "Financial Communications" and .confidence == "high"
    )
    and any(body.links, strings.icontains(.display_text, "claim"))
  )
)
and not (
  sender.email.domain.root_domain in ("sedgwick.com", "sedgwickcms.com")
  and coalesce(headers.auth_summary.dmarc.pass, false)
)

Data Sources

Email MessagesEmail HeadersEmail Attachments

Platforms

Raw Content

name: "Brand impersonation: Sedgwick Claims"
description: "Detects inbound messages that impersonate Sedgwick Claims Management Services, either through a display name containing 'Sedgwick Claim' or through NLU classification identifying Sedgwick as an organization entity alongside high-confidence financial communication topics. Legitimate messages from verified Sedgwick domains (sedgwick.com or sedgwickcms.com) that pass DMARC authentication are excluded."
type: "rule"
severity: "medium"
source: |
  type.inbound
  and (
    strings.icontains(sender.display_name, "Sedgwick Claim")
    or (
      any(ml.nlu_classifier(body.current_thread.text).entities,
          .name == "sender" and .text == "Sedgwick"
      )
      and any(ml.nlu_classifier(body.current_thread.text).topics,
              .name == "Financial Communications" and .confidence == "high"
      )
      and any(body.links, strings.icontains(.display_text, "claim"))
    )
  )
  and not (
    sender.email.domain.root_domain in ("sedgwick.com", "sedgwickcms.com")
    and coalesce(headers.auth_summary.dmarc.pass, false)
  )
attack_types:
  - "BEC/Fraud"
  - "Credential Phishing"
tactics_and_techniques:
  - "Impersonation: Brand"
  - "Spoofing"
  - "Social engineering"
detection_methods:
  - "Natural Language Understanding"
  - "Sender analysis"
  - "Header analysis"
id: "e9f2c14d-bf70-5205-8cba-ccf04017904f"