Add detection rule for Claude impersonation

detection-rules/impersonation_claude_domain.yml

@@ -0,0 +1,46 @@
+name: "Brand impersonation: Claude with newly registered domains"
+description: "Detects messages impersonating Anthropic or Claude using sender display names of 'Anthropic' or 'Claude' from domains not affiliated with the legitimate brands. The rule flags messages where the sending domain, reply-to domain, or return-path domain is newly registered (under 90 days old)."
+type: "rule"
+severity: "medium"
+source: |
+  type.inbound
+  and not sender.email.domain.root_domain in ("claude.com", "anthropic.com")
+  and sender.display_name in ("Anthropic", "Claude")
+  // links created less than 90 days
+  and any(body.links, network.whois(.href_url.domain).days_old <= 90)
+  and (
+    // or the return path or sender domain is less than 90 days old
+    network.whois(sender.email.domain).days_old <= 90
+    or network.whois(headers.return_path.domain).days_old <= 90
+  )
+  and (
+    strings.icontains(body.current_thread.text, "claude")
+    or strings.icontains(body.current_thread.text, "claude ads")
+    or strings.icontains(body.current_thread.text, "anthropic team")
+    or strings.contains(body.current_thread.text,
+                        "Anthropic PBC, 548 Market St, PMB 90375, San Francisco, CA 94104"
+    )
+    or strings.icontains(subject.base, "*claude*")
+    or strings.icontains(subject.base, "*anthropic*")
+    or regex.icontains(subject.base,
+                       "(?:early.{0,20}claude|claude.{0,20}(?:early.access|ads))"
+    )
+  )
+  // negate highly trusted sender domains unless they fail DMARC authentication
+  and not (
+    sender.email.domain.root_domain in $high_trust_sender_root_domains
+    and coalesce(headers.auth_summary.dmarc.pass, false)
+  )
+attack_types:
+  - "BEC/Fraud"
+  - "Spam"
+tactics_and_techniques:
+  - "Lookalike domain"
+  - "Social engineering"
+  - "Spoofing"
+detection_methods:
+  - "Content analysis"
+  - "Header analysis"
+  - "Sender analysis"
+  - "Whois"
+id: "02d16c54-a773-5286-b7a8-7b37551ccba5"