Detection rules › Sublime MQL
Brand impersonation: TurboTax
Impersonation of the TurboTax service from Intuit. Most commonly seen around US tax season (Q1).
Threat classification
Sublime's own taxonomy (not MITRE ATT&CK).
| Category | Values |
|---|---|
| Attack types | Credential Phishing |
| Tactics and techniques | Impersonation: Brand, Lookalike domain, Social engineering |
Event coverage
Rule body MQL
type.inbound
and (
strings.ilike(sender.display_name, '*turbotax*')
or (
strings.ilevenshtein(sender.display_name, 'turbotax') <= 1
// negates FP for company called TurboTan
and not (
sender.display_name == "TurboTan"
and sender.email.domain.root_domain == "brevosend.com"
and headers.auth_summary.spf.pass
)
)
or strings.ilike(sender.email.domain.domain, '*turbotax*')
)
and sender.email.domain.root_domain not in (
'intuit.com',
'turbotax.com',
'intuit.ca',
'truist.com' // Truist partners with Intuit to provide discounts
)
and sender.email.email not in $recipient_emails
// negates survery service used by TurboTax
and not (
sender.email.domain.root_domain in ('qemailserver.com')
and headers.auth_summary.spf.pass
and any(body.links,
.href_url.domain.root_domain in ("qualtrics.com", "intuit.com")
)
)
Detection logic
Scope: inbound message.
Impersonation of the TurboTax service from Intuit. Most commonly seen around US tax season (Q1).
- inbound message
any of:
- sender.display_name matches '*turbotax*'
all of:
- sender.display_name is similar to 'turbotax'
not:
all of:
- sender.display_name is 'TurboTan'
- sender.email.domain.root_domain is 'brevosend.com'
- headers.auth_summary.spf.pass
- sender.email.domain.domain matches '*turbotax*'
- sender.email.domain.root_domain not in ('intuit.com', 'turbotax.com', 'intuit.ca', 'truist.com')
- sender.email.email not in $recipient_emails
not:
all of:
- sender.email.domain.root_domain in ('qemailserver.com')
- headers.auth_summary.spf.pass
any of
body.linkswhere:- .href_url.domain.root_domain in ('qualtrics.com', 'intuit.com')
Inspects: body.links, body.links[].href_url.domain.root_domain, headers.auth_summary.spf.pass, sender.display_name, sender.email.domain.domain, sender.email.domain.root_domain, sender.email.email, type.inbound. Sensors: strings.ilevenshtein, strings.ilike. Reference lists: $recipient_emails.
Indicators matched (11)
| Field | Match | Value |
|---|---|---|
strings.ilike | substring | *turbotax* |
strings.ilevenshtein | fuzzy | turbotax |
sender.display_name | equals | TurboTan |
sender.email.domain.root_domain | equals | brevosend.com |
sender.email.domain.root_domain | member | intuit.com |
sender.email.domain.root_domain | member | turbotax.com |
sender.email.domain.root_domain | member | intuit.ca |
sender.email.domain.root_domain | member | truist.com |
sender.email.domain.root_domain | member | qemailserver.com |
body.links[].href_url.domain.root_domain | member | qualtrics.com |
body.links[].href_url.domain.root_domain | member | intuit.com |