Detection rules › Sublime MQL

Sublime MQL rules: intuit

Rule	Severity
Link: Intuit link abuse with file share context	`medium`

Link: Intuit link abuse with file share context

Severity: medium
Type: rule
Source: github.com/sublime-security/sublime-rules

Detects messages linking to Intuit notification domains from non-Intuit senders, combined with credential harvesting language and file sharing themes

Threat Classification

Sublime's own taxonomy (not MITRE ATT&CK).

Category	Values
Attack types	Credential Phishing
Tactics and techniques	Impersonation: Brand, Social engineering

Telemetry Coverage

Platform	Record / event type
Sublime	Inbound email message

Message Attributes

body
body.current_thread
body.links
sender.email
type

Rule Body

type.inbound
// look for links to links.notification.intuit.com but the sender is not from quickbooks/intuit
and any(body.links, .href_url.domain.domain == "links.notification.intuit.com")
and sender.email.domain.root_domain not in ("quickbooks.com", "intuit.com")
// check to see if it is classified as cred_theft
and any(ml.nlu_classifier(body.current_thread.text).intents,
        .name in ("cred_theft") and .confidence != "low"
)
and length(body.current_thread.text) < 1750
// check to see if the topic is File Sharing & Cloud Services
and any(beta.ml_topic(body.current_thread.text).topics,
        .name == "File Sharing and Cloud Services" and .confidence != "low"
)

Detection Logic

Scope: inbound message.

Detects messages linking to Intuit notification domains from non-Intuit senders, combined with credential harvesting language and file sharing themes

inbound message
any of body.links where:
- .href_url.domain.domain is 'links.notification.intuit.com'
sender.email.domain.root_domain not in ('quickbooks.com', 'intuit.com')
any(ml.nlu_classifier(body.current_thread.text).intents, .name in ("cred_theft") and .confidence != "low" )
length(body.current_thread.text) < 1750
any(beta.ml_topic(body.current_thread.text).topics, .name == "File Sharing and Cloud Services" and .confidence != "low" )

Inspects: body.current_thread.text, body.links, body.links[].href_url.domain.domain, sender.email.domain.root_domain, type.inbound. Sensors: beta.ml_topic, ml.nlu_classifier.

Indicators Matched (3)

Field	Match	Value
`body.links[].href_url.domain.domain`	equals	`links.notification.intuit.com`
`ml.nlu_classifier(body.current_thread.text).intents[].name`	member	`cred_theft`
`beta.ml_topic(body.current_thread.text).topics[].name`	equals	`File Sharing and Cloud Services`

Stages and Predicates

Stage 1: `mql_rule`

and
  any(body.links)
    body.links.href_url.domain.domain eq "links.notification.intuit.com"
  not
    sender.email.domain.root_domain in ["intuit.com", "quickbooks.com"]
  body.current_thread.text length_compare "1750"
  type.inbound eq "true"
   macro "any(beta.ml_topic(body.current_thread.text).topics,\n        .name == \"File Sharing and Cloud Services\" and .confidence != \"low\"\n)"
   macro "any(ml.nlu_classifier(body.current_thread.text).intents,\n        .name in (\"cred_theft\") and .confidence != \"low\"\n)"

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`type.inbound`	eq	`true` transforms: `boolean` corpus 1212 (mql 1212)	`field:"type.inbound" kind:eq value:"true"`

Exclusions

The rule actively suppresses these predicates.

Field	Kind	Excluded values	Search
`sender.email.domain.root_domain`	in	`intuit.com`, `quickbooks.com`	`excludes:sender.email.domain.root_domain` `field:"sender.email.domain.root_domain" value:"intuit.com"` `field:"sender.email.domain.root_domain" value:"quickbooks.com"`

Back to all Sublime MQL rules