Detection rules › Sublime MQL
Brand impersonation: QuickBooks notification from Intuit themed company name
This detection rule matches on QuickBooks notifications that feature company names impersonating Intuit and QuickBooks.
Threat classification
Sublime's own taxonomy (not MITRE ATT&CK).
| Category | Values |
|---|---|
| Attack types | Callback Phishing, Credential Phishing, BEC/Fraud |
| Tactics and techniques | Evasion, Social engineering |
Event coverage
Rule body MQL
type.inbound
// Legitimate Intuit sending infratructure
and sender.email.email == "quickbooks@notification.intuit.com"
and headers.auth_summary.spf.pass
and headers.auth_summary.dmarc.pass
and strings.ends_with(headers.auth_summary.spf.details.designator,
'.intuit.com'
)
and (
// the reply-to contains Inuit Themes
any(headers.reply_to,
(
strings.icontains(.email.email, 'intuit')
or strings.icontains(.email.domain.domain, 'quickbooks')
)
and not (.email.domain.root_domain in ('intuit.com', 'quickbooks.com'))
)
// the "company" part of the message
or regex.icontains(body.html.raw,
'<(?:div|p) class="company(?:Name|Details)[^\"]*\"[^\>]*\>[^\<]*(?:Intuit|Quickbooks).*</(?:p|div)>'
)
)
Detection logic
Scope: inbound message.
This detection rule matches on QuickBooks notifications that feature company names impersonating Intuit and QuickBooks.
- inbound message
- sender.email.email is 'quickbooks@notification.intuit.com'
- headers.auth_summary.spf.pass
- headers.auth_summary.dmarc.pass
- headers.auth_summary.spf.details.designator ends with '.intuit.com'
any of:
any of
headers.reply_towhere all hold:any of:
- .email.email contains 'intuit'
- .email.domain.domain contains 'quickbooks'
not:
- .email.domain.root_domain in ('intuit.com', 'quickbooks.com')
- body.html.raw matches '<(?:div|p) class="company(?:Name|Details)[^\\"]*\\"[^\\>]*\\>[^\\<]*(?:Intuit|Quickbooks).*</(?:p|div)>'
Inspects: body.html.raw, headers.auth_summary.dmarc.pass, headers.auth_summary.spf.details.designator, headers.auth_summary.spf.pass, headers.reply_to, headers.reply_to[].email.domain.domain, headers.reply_to[].email.domain.root_domain, headers.reply_to[].email.email, sender.email.email, type.inbound. Sensors: regex.icontains, strings.ends_with, strings.icontains.
Indicators matched (7)
| Field | Match | Value |
|---|---|---|
sender.email.email | equals | quickbooks@notification.intuit.com |
strings.ends_with | suffix | .intuit.com |
strings.icontains | substring | intuit |
strings.icontains | substring | quickbooks |
headers.reply_to[].email.domain.root_domain | member | intuit.com |
headers.reply_to[].email.domain.root_domain | member | quickbooks.com |
regex.icontains | regex | <(?:div|p) class="company(?:Name|Details)[^\"]*\"[^\>]*\>[^\<]*(?:Intuit|Quickbooks).*</(?:p|div)> |