Detection rules › Sublime MQL
Link: Intuit link abuse with file share context
Detects messages linking to Intuit notification domains from non-Intuit senders, combined with credential harvesting language and file sharing themes
Threat classification
Sublime's own taxonomy (not MITRE ATT&CK).
| Category | Values |
|---|---|
| Attack types | Credential Phishing |
| Tactics and techniques | Impersonation: Brand, Social engineering |
Event coverage
| Message attribute |
|---|
| body |
| body.current_thread |
| body.links (collection) |
| sender.email |
| type |
Rule body MQL
type.inbound
// look for links to links.notification.intuit.com but the sender is not from quickbooks/intuit
and any(body.links, .href_url.domain.domain == "links.notification.intuit.com")
and sender.email.domain.root_domain not in ("quickbooks.com", "intuit.com")
// check to see if it is classified as cred_theft
and any(ml.nlu_classifier(body.current_thread.text).intents,
.name in ("cred_theft") and .confidence != "low"
)
and length(body.current_thread.text) < 1750
// check to see if the topic is File Sharing & Cloud Services
and any(beta.ml_topic(body.current_thread.text).topics,
.name == "File Sharing and Cloud Services" and .confidence != "low"
)
Detection logic
Scope: inbound message.
Detects messages linking to Intuit notification domains from non-Intuit senders, combined with credential harvesting language and file sharing themes
- inbound message
any of
body.linkswhere:- .href_url.domain.domain is 'links.notification.intuit.com'
- sender.email.domain.root_domain not in ('quickbooks.com', 'intuit.com')
any of
ml.nlu_classifier(body.current_thread.text).intentswhere all hold:- .name in ('cred_theft')
- .confidence is not 'low'
- length(body.current_thread.text) < 1750
any of
beta.ml_topic(body.current_thread.text).topicswhere all hold:- .name is 'File Sharing and Cloud Services'
- .confidence is not 'low'
Inspects: body.current_thread.text, body.links, body.links[].href_url.domain.domain, sender.email.domain.root_domain, type.inbound. Sensors: beta.ml_topic, ml.nlu_classifier.
Indicators matched (5)
| Field | Match | Value |
|---|---|---|
body.links[].href_url.domain.domain | equals | links.notification.intuit.com |
sender.email.domain.root_domain | member | quickbooks.com |
sender.email.domain.root_domain | member | intuit.com |
ml.nlu_classifier(body.current_thread.text).intents[].name | member | cred_theft |
beta.ml_topic(body.current_thread.text).topics[].name | equals | File Sharing and Cloud Services |