Brand impersonation: QuickBooks dispute notification

type.inbound
and any([subject.base, sender.display_name],
        strings.icontains(., 'Quickbooks', 'Intuit')
)
and any([subject.base, sender.display_name, body.current_thread.text],
        regex.icontains(., 'Dispute\s+(?:Notification|Resolution)')
)
and not (
  sender.email.domain.root_domain in~ (
    'intuit.com',
    'turbotax.com',
    'intuit.ca',
    'meliopayments.com',
    'qemailserver.com',
    'intuit.co.uk',
    'quickbooksonline.com',
    'tsheets.com'
  )
  and coalesce(headers.auth_summary.dmarc.pass, false)
)