[Shared Samples] [PR #4683] added rule: PR# 4683 - Brand impersonation: Claude with newly registered domains

Author: github-actions[bot]

detection-rules/4683_impersonation_claude_domain.yml

@@ -0,0 +1,57 @@
+name: "PR# 4683 - Brand impersonation: Claude with newly registered domains"
+description: "Detects messages impersonating Anthropic or Claude using sender display names of 'Anthropic' or 'Claude' from domains not affiliated with the legitimate brands. The rule flags messages where the sending domain, reply-to domain, or return-path domain is newly registered (under 60 days old)."
+type: "rule"
+severity: "medium"
+source: |
+  type.inbound
+  and not sender.email.domain.root_domain in ("claude.com", "anthropic.com")
+  and sender.display_name in ("Anthropic", "Claude")
+  // a newly created domain
+  and (
+    all(headers.reply_to,
+        .email.domain.root_domain not in $free_email_providers
+        and network.whois(.email.domain).days_old <= 60
+        and .email.email != sender.email.email
+    )
+    // or the return path or sender domain is less than 60d old
+    or network.whois(headers.return_path.domain).days_old <= 60
+    or network.whois(sender.email.domain).days_old <= 60
+  )
+  and (
+    (
+      strings.contains(body.current_thread.text, "Claude")
+      and strings.icontains(body.current_thread.text, "claude ads")
+    )
+    or strings.icontains(body.current_thread.text, "anthropic, pbc")
+    or regex.icontains(subject.base,
+                       "(?:early.{0,20}claude|claude.{0,20}(?:early.access|ads))"
+    )
+  )
+  // and any(body.links,
+  //         strings.icontains(.href_url.domain.domain, 'claude-marketing-team.com')
+  //         or strings.icontains(.href_url.domain.domain, 'anthropic-ads.com')
+  // )
+  // negate highly trusted sender domains unless they fail DMARC authentication
+  and not (
+    sender.email.domain.root_domain in $high_trust_sender_root_domains
+    and coalesce(headers.auth_summary.dmarc.pass, false)
+  )
+attack_types:
+  - "BEC/Fraud"
+  - "Spam"
+tactics_and_techniques:
+  - "Lookalike domain"
+  - "Social engineering"
+  - "Spoofing"
+detection_methods:
+  - "Content analysis"
+  - "Header analysis"
+  - "Sender analysis"
+  - "Whois"
+id: "eea62f23-04c6-59ad-af52-8677a33f164a"
+tags:
+  - created_from_open_prs
+  - rule_status_added
+  - pr_author_cybher0808
+references:
+  - https://github.com/sublime-security/sublime-rules/pull/4683