detection.wiki

Detection rules › Sublime MQL

Service abuse: QuickBooks notification with suspicious comments

Severity
medium
Type
rule
Source
github.com/sublime-security/sublime-rules

This detection rule matches QuickBooks notifications that contain suspicious keywords within the comments section of the notification

Threat classification

Sublime's own taxonomy (not MITRE ATT&CK).

CategoryValues
Attack typesCallback Phishing, Credential Phishing, BEC/Fraud
Tactics and techniquesEvasion, Social engineering

Event coverage

Message attribute
body
body.html
sender.email
subject
type

Rule body MQL

type.inbound

// Legitimate Intuit sending infratructure
and sender.email.email == "quickbooks@notification.intuit.com"

// remove payment confirmation messages
and not strings.starts_with(subject.subject, 'Payment confirmation:')
and body.html.raw is not null
// Comments contains suspicious phrases
and (
  // several different templates where commonly observed, run regex for each template
  any([
        html.xpath(body.html,
                   '//span[@id="condensedEmailMessageSectionContentWebPlayer"]'
        ).nodes,
        html.xpath(body.html, '//div[@id="emailContainer"]').nodes,
        html.xpath(body.html, '//table[@width="700"][1]//tr/td').nodes,
        html.xpath(body.html, '//tr[@class="email-header"]').nodes,
        html.xpath(body.html, '//tr[@class="email-center"]').nodes,
        html.xpath(body.html, '//div[@class="mlr22"]').nodes,
        html.xpath(body.html, '//td[@class="itemDesc"]//div').nodes,
        html.xpath(body.html, '//td[@class="shippingContent"]//div').nodes,
        html.xpath(body.html,
                   '//table[@class="shippingAndCustomLayout width100"]'
        ).nodes
      ],
      any(.,
          regex.icontains(.inner_text,
                          // subscription, renewals, verificaitons, etc
                          '(?:your subscription renewal|couldn.?t be processed|trouble renewing subscription|update your details|just update your|continue your subscription|prefer to use EFT|change payment method|verify your account|suspended due to issue|payment declined notice|account needs verification|confirm your billing|immediate action required|failed payment notification|billing information update|service interruption warning|unable to process payment|subscription payment failed|action needed now|update banking information|subscription expiration notice|payment method change|bill\s+to\s+subscriber)',
                          // callback wording
                          'recognize this seller?|For more info.{0,25}Call|To cancel.{0,25}Call|did not authorize',
          )
      )
  )
)

Detection logic

Scope: inbound message.

This detection rule matches QuickBooks notifications that contain suspicious keywords within the comments section of the notification

  1. inbound message
  2. sender.email.email is 'quickbooks@notification.intuit.com'
  3. not:
    • subject.subject starts with 'Payment confirmation:'
  4. body.html.raw is set
  5. any of [html.xpath(body.html, '//span[@id="condensedEmailMessageSectionContentWebPlayer"]').nodes, html.xpath(body.html, '//div[@id="emailContainer"]').nodes, html.xpath(body.html, '//table[@width="700"][1]//tr/td').nodes, html.xpath(body.html, '//tr[@class="email-header"]').nodes, html.xpath(body.html, '//tr[@class="email-center"]').nodes, html.xpath(body.html, '//div[@class="mlr22"]').nodes, html.xpath(body.html, '//td[@class="itemDesc"]//div').nodes, html.xpath(body.html, '//td[@class="shippingContent"]//div').nodes, html.xpath(body.html, '//table[@class="shippingAndCustomLayout width100"]').nodes] where:
    • any of . where:
      • .inner_text matches any of 2 patterns
        • (?:your subscription renewal|couldn.?t be processed|trouble renewing subscription|update your details|just update your|continue your subscription|prefer to use EFT|change payment method|verify your account|suspended due to issue|payment declined notice|account needs verification|confirm your billing|immediate action required|failed payment notification|billing information update|service interruption warning|unable to process payment|subscription payment failed|action needed now|update banking information|subscription expiration notice|payment method change|bill\s+to\s+subscriber)
        • recognize this seller?|For more info.{0,25}Call|To cancel.{0,25}Call|did not authorize

Inspects: body.html, body.html.raw, sender.email.email, subject.subject, type.inbound. Sensors: html.xpath, regex.icontains, strings.starts_with.

Indicators matched (4)

FieldMatchValue
sender.email.emailequalsquickbooks@notification.intuit.com
strings.starts_withprefixPayment confirmation:
regex.icontainsregex(?:your subscription renewal|couldn.?t be processed|trouble renewing subscription|update your details|just update your|continue your subscription|prefer to use EFT|change payment method|verify your account|suspended due to issue|payment declined notice|account needs verification|confirm your billing|immediate action required|failed payment notification|billing information update|service interruption warning|unable to process payment|subscription payment failed|action needed now|update banking information|subscription expiration notice|payment method change|bill\s+to\s+subscriber)
regex.icontainsregexrecognize this seller?|For more info.{0,25}Call|To cancel.{0,25}Call|did not authorize