Brand impersonation: Quickbooks
Impersonation of the Quickbooks service from Intuit.
Sublime rule (View on GitHub)
1name: "Brand impersonation: Quickbooks"
2description: "Impersonation of the Quickbooks service from Intuit."
3type: "rule"
4severity: "medium"
5source: |
6 type.inbound
7 and (
8 (
9 strings.ilike(sender.display_name,
10 'quickboo*',
11 'QuickB*',
12 'QBook*',
13 'intuit*'
14 )
15 or strings.like(sender.display_name, "QB-*", "QB *")
16 or strings.ilevenshtein(sender.display_name, 'quickbooks') <= 1
17 or strings.ilike(sender.email.domain.domain, '*quickbook*')
18 or (
19 length(filter(ml.nlu_classifier(body.current_thread.text).entities,
20 strings.icontains(.text, "quickbooks")
21 )
22 ) > 2
23 and any(ml.nlu_classifier(body.current_thread.text).intents,
24 .name == "cred_theft"
25 )
26 )
27 )
28 or strings.ilike(body.current_thread.text, "*invoice*")
29 )
30 and (
31 any(ml.logo_detect(file.message_screenshot()).brands,
32 .name == "Quickbooks" and .confidence in ("medium", "high")
33 )
34 // contains the address and copyright
35 or (
36 strings.icontains(body.current_thread.text,
37 '2800 E. Commerce Center Place, Tucson, AZ 85706',
38 '2700 Coast Ave, Mountain View, CA 94043'
39 )
40 and regex.icontains(body.current_thread.text, '©\s*(?:\d+)\s*Intuit')
41 )
42 or strings.icontains(body.current_thread.text,
43 'Powered by QuickBooks',
44 'QuickBooks and Intuit are trademarks of Intuit Inc.',
45 "QuickBooks Cloud Services",
46 "QuickBooks Support Center",
47 "QuickBooks subscription"
48 )
49 or regex.icontains(body.current_thread.text,
50 '(?:Secured by )?QuickBooks Payments'
51 )
52
53 // phone number and update language
54 or (
55 regex.icontains(body.current_thread.text,
56 '\+?([ilo0-9]{1}.)?\(?[ilo0-9]{3}?\)?.[ilo0-9]{3}.?[ilo0-9]{4}',
57 '\+?([ilo0-9]{1,2})?\s?\(?\d{3}\)?[\s\.\-⋅]{0,5}[ilo0-9]{3}[\s\.\-⋅]{0,5}[ilo0-9]{4}'
58 )
59 and any(ml.nlu_classifier(body.current_thread.text).topics,
60 .name in ("Software and App Updates", "Security and Authentication")
61 )
62
63 // we need to re-check for QB indicators, otherwise we can have "*invoice*"
64 // and this block, which is much more than just QB impersonation
65 and (
66 strings.ilike(sender.display_name,
67 'quickbook*',
68 'QuickB*',
69 'QBook*',
70 'intuit*'
71 )
72 or strings.like(sender.display_name, "QB-*", "QB *")
73 or strings.ilevenshtein(sender.display_name, 'quickbooks') <= 1
74 or strings.ilike(sender.email.domain.domain, '*quickbook*')
75 or (
76 length(filter(ml.nlu_classifier(body.current_thread.text).entities,
77 strings.icontains(.text, "quickbooks")
78 )
79 ) > 2
80 and any(ml.nlu_classifier(body.current_thread.text).intents,
81 .name == "cred_theft"
82 )
83 )
84 )
85 )
86 or any(body.links,
87 (
88 regex.icontains(.display_url.url, '(?:quickbooks|intuit)')
89 and .mismatched
90 and not .href_url.domain.root_domain in (
91 "mimecast.com",
92 "mimecastprotect.com"
93 )
94 )
95 or (
96 regex.icontains(.href_url.path, '(?:quickbooks|intuit)')
97 and not strings.icontains(.href_url.domain.root_domain,
98 "quickbooks",
99 "intuit"
100 )
101 and not any(ml.nlu_classifier(body.current_thread.text).topics,
102 .name == "Advertising and Promotions"
103 )
104 )
105 )
106 or (
107 any(ml.nlu_classifier(body.current_thread.text).entities,
108 .name == "sender" and regex.icontains(.text, 'quickbooks?')
109 )
110 and any(ml.nlu_classifier(body.current_thread.text).intents,
111 .name == "cred_theft" and .confidence == "high"
112 )
113 )
114 )
115 and not (
116 sender.email.domain.root_domain in~ (
117 'intuit.com',
118 'turbotax.com',
119 'intuit.ca',
120 'meliopayments.com',
121 'qemailserver.com',
122 'intuit.co.uk',
123 'quickbooksonline.com',
124 'tsheets.com'
125 )
126 and coalesce(headers.auth_summary.dmarc.pass, false)
127 )
128 and (
129 not profile.by_sender().any_messages_benign
130 and not profile.by_sender().solicited
131 )
132 // links in body are not known QB domains or the senders root website (both indicative of a legitimate QuickBooks invoice message)
133 and (
134 length(filter(body.links,
135 .href_url.domain.root_domain in~ (
136 'intuit.com',
137 'turbotax.com',
138 'intuit.ca',
139 'meliopayments.com',
140 'qemailserver.com',
141 'intuit.co.uk',
142 'quickbooksonline.com'
143 )
144 or (
145 .href_url.domain.root_domain == sender.email.domain.root_domain
146 and (.href_url.path is null or .href_url.path == "/")
147 )
148 // handle links to the root website when the sender uses a freemail address to send invoices
149 or (
150 .href_url.domain.sld == sender.email.local_part
151 and (.href_url.path is null or .href_url.path == "/")
152 and sender.email.domain.root_domain in $free_email_providers
153 )
154 )
155 ) != length(body.links)
156 // or no valid links
157 or length(filter(body.links, .href_url.domain.domain is not null)) == 0
158 )
159 // the call to action link does not lead to inuit
160 and not (
161 // filter down to observed call to action display text
162 any(filter(body.links,
163 .display_text in~ (
164 "view and pay",
165 "review and pay",
166 "view details"
167 )
168 ),
169 // benign/legit href_url details for those links
170 (
171 // sendgrid rewritten links
172 .href_url.domain.domain == "links.notification.intuit.com"
173 // CTA link
174 or (
175 .href_url.domain.domain == "connect.intuit.com"
176 and strings.icontains(.href_url.query_params, 'cta=viewinvoicenow')
177 )
178 // Mimecast links
179 or (
180 .href_url.domain.root_domain == "mimecastprotect.com"
181 and (
182 strings.icontains(.href_url.query_params,
183 'domain=links.notification.intuit.com'
184 )
185 or strings.icontains(.href_url.query_params,
186 'domain=connect.intuit.com'
187 )
188 )
189 )
190 )
191 )
192 )
193 // negate common sender of quickbooks reseller
194 and not strings.icontains(body.current_thread.text, 'Purchasing Reviews, Inc')
195 // negate highly trusted sender domains unless they fail DMARC authentication
196 and not (
197 sender.email.domain.root_domain in $high_trust_sender_root_domains
198 and coalesce(headers.auth_summary.dmarc.pass, false)
199 )
200attack_types:
201 - "Callback Phishing"
202 - "Credential Phishing"
203tactics_and_techniques:
204 - "Impersonation: Brand"
205 - "Social engineering"
206detection_methods:
207 - "Computer Vision"
208 - "Content analysis"
209 - "Header analysis"
210 - "Sender analysis"
211id: "4fd791d1-a053-5c2d-80dd-c6dcdc112a62"