Detection rules › Sublime MQL

Sublime MQL rules: intuit

Rule	Severity
Link: Intuit link abuse with file share context	`medium`

Link: Intuit link abuse with file share context

Severity: medium
Type: rule
Source: github.com/sublime-security/sublime-rules

Detects messages linking to Intuit notification domains from non-Intuit senders, combined with credential harvesting language and file sharing themes

Threat classification

Sublime's own taxonomy (not MITRE ATT&CK).

Category	Values
Attack types	Credential Phishing
Tactics and techniques	Impersonation: Brand, Social engineering

Telemetry coverage

Platform	Record / event type
Sublime	Inbound email message

Message attributes

body
body.current_thread
body.links
sender.email
type

Rule body

type.inbound
// look for links to links.notification.intuit.com but the sender is not from quickbooks/intuit
and any(body.links, .href_url.domain.domain == "links.notification.intuit.com")
and sender.email.domain.root_domain not in ("quickbooks.com", "intuit.com")
// check to see if it is classified as cred_theft
and any(ml.nlu_classifier(body.current_thread.text).intents,
        .name in ("cred_theft") and .confidence != "low"
)
and length(body.current_thread.text) < 1750
// check to see if the topic is File Sharing & Cloud Services
and any(beta.ml_topic(body.current_thread.text).topics,
        .name == "File Sharing and Cloud Services" and .confidence != "low"
)

Detection logic

Scope: inbound message.

Detects messages linking to Intuit notification domains from non-Intuit senders, combined with credential harvesting language and file sharing themes

inbound message
any of body.links where:
- .href_url.domain.domain is 'links.notification.intuit.com'
sender.email.domain.root_domain not in ('quickbooks.com', 'intuit.com')
any of ml.nlu_classifier(body.current_thread.text).intents where all hold:
- .name in ('cred_theft')
- .confidence is not 'low'
length(body.current_thread.text) < 1750
any of beta.ml_topic(body.current_thread.text).topics where all hold:
- .name is 'File Sharing and Cloud Services'
- .confidence is not 'low'

Inspects: body.current_thread.text, body.links, body.links[].href_url.domain.domain, sender.email.domain.root_domain, type.inbound. Sensors: beta.ml_topic, ml.nlu_classifier.

Indicators matched (3)

Field	Match	Value
`body.links[].href_url.domain.domain`	equals	`links.notification.intuit.com`
`ml.nlu_classifier(body.current_thread.text).intents[].name`	member	`cred_theft`
`beta.ml_topic(body.current_thread.text).topics[].name`	equals	`File Sharing and Cloud Services`

Stages and Predicates

Stage 1: `mql_rule`

and
  any(beta.ml_topic(body.current_thread.text).topics)
    and
      beta.ml_topic(body.current_thread.text).topics.confidence ne "low"
      beta.ml_topic(body.current_thread.text).topics.name eq "File Sharing and Cloud Services"
  any(ml.nlu_classifier(body.current_thread.text).intents)
    and
      ml.nlu_classifier(body.current_thread.text).intents.confidence ne "low"
      ml.nlu_classifier(body.current_thread.text).intents.name eq "cred_theft"
  any(body.links)
    body.links.href_url.domain.domain eq "links.notification.intuit.com"
  not
    sender.email.domain.root_domain in ["intuit.com", "quickbooks.com"]
  body.current_thread.text length_compare "1750"
  type.inbound eq "true"

Exclusions

The rule actively suppresses these predicates.

Field	Kind	Excluded values	Search
`sender.email.domain.root_domain`	in	`intuit.com`, `quickbooks.com`	`excludes:sender.email.domain.root_domain` `field:"sender.email.domain.root_domain" value:"intuit.com"` `field:"sender.email.domain.root_domain" value:"quickbooks.com"`

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`type.inbound`	eq	`true` transforms: `boolean`	`field:"type.inbound" kind:eq value:"true"`