Sync from PR#862

New rule: impersonation_quickbooks.yml by @aidenmitchell
#862
Source SHA f65c491
Triggered by @morriscode

detection-rules/impersonation_quickbooks.yml

@@ -0,0 +1,19 @@
+name: "Brand impersonation: Quickbooks"
+description: "Impersonation of the Quickbooks service from Intuit."
+type: "rule"
+severity: "medium"
+source: "type.inbound\nand (\n  (\n    strings.ilike(sender.display_name, '*quickbooks*')\n    or strings.ilevenshtein(sender.display_name, 'quickbooks') <= 1\n    or strings.ilike(sender.email.domain.domain, '*quickbooks*')\n  )\n  or strings.ilike(body.current_thread.text, \"*invoice*\")\n)\nand any(ml.logo_detect(beta.message_screenshot()).brands,\n        .name == \"Quickbooks\" and .confidence in (\"medium\", \"high\")\n)\nand sender.email.domain.root_domain not in~ ('intuit.com', 'turbotax.com', 'intuit.ca')\nand (\n    not profile.by_sender().any_false_positives \n    and not profile.by_sender().solicited\n)\n"
+attack_types:
+  - "Callback Phishing"
+  - "Credential Phishing"
+tactics_and_techniques:
+  - "Impersonation: Brand"
+  - "Social engineering"
+detection_methods:
+  - "Computer Vision"
+  - "Content analysis"
+  - "Header analysis"
+  - "Sender analysis"
+id: "4fd791d1-a053-5c2d-80dd-c6dcdc112a62"
+testing_pr: 862
+testing_sha: f65c491ca98c94aa26441668eba757a9e474cebb