Sublime Security medium experimental mql

Brand impersonation: Anthropic/Claude with newly registered domain

Detects messages impersonating Anthropic or Claude using sender display names of 'Anthropic' or 'Claude' from domains not affiliated with the legitimate brands. The rule flags messages where the sending domain, reply-to domain, or return-path domain is newly registered (under 90 days old).

View Source

Detection Logic

type.inbound
and regex.icontains(sender.display_name, '(?:claude
| anthropic)')
// sender display name with claude, anthropic - created less than 90 days
and network.whois(sender.email.domain).days_old <= 90

// common theme for suspicious claude, anthropic
and 2 of (
  strings.icontains(body.current_thread.text, "ad account"),
  strings.icontains(body.current_thread.text, "claude ads"),
  strings.icontains(body.current_thread.text, "trial access"),
  strings.icontains(body.current_thread.text, "subscription"),
  strings.icontains(body.current_thread.text, "workspace"),
  strings.icontains(body.current_thread.text, 'ads team'),
  strings.icontains(body.current_thread.text, 'google ads'),
  regex.icontains(body.current_thread.text, "connect.{0,30}account"),
  regex.icontains(body.current_thread.text, '\banthropic\s+(?:team
| pbc)\b'),
  2 of (
    strings.icontains(body.current_thread.text, '548 Market Street'),
    strings.icontains(body.current_thread.text, 'San Francisco'),
    strings.icontains(body.current_thread.text, 'CA 94104')
  ),
  any(ml.nlu_classifier(body.current_thread.text).entities,
      .name == "sender"
      and strings.icontains(.text, "Claude", "Anthropic")
      and strings.iends_with(.text, "Team")
  )
)

// negate highly trusted sender domains unless they fail DMARC authentication
and not (
  sender.email.domain.root_domain in $high_trust_sender_root_domains
  and coalesce(headers.auth_summary.dmarc.pass, false)
)

Field Validations

Loading…

Comments (0)

Loading comments...