Brand impersonation: QuickBooks notification from Intuit themed company name

type.inbound

// Legitimate Intuit sending infratructure
and sender.email.email == "quickbooks@notification.intuit.com"
and headers.auth_summary.spf.pass
and headers.auth_summary.dmarc.pass
and strings.ends_with(headers.auth_summary.spf.details.designator,
                      '.intuit.com'
)
and (
  // the reply-to contains Inuit Themes
  any(headers.reply_to,
         (
           strings.icontains(.email.email, 'intuit')
           or strings.icontains(.email.domain.domain, 'quickbooks')
         )
         and not (.email.domain.root_domain in ('intuit.com', 'quickbooks.com'))
  )
  // the "company" part of the message
  or regex.icontains(body.html.raw,
                     '<(?:div|p) class="company(?:Name|Details)[^\"]*\"[^\>]*\>[^\<]*(?:Intuit|Quickbooks).*</(?:p|div)>'
  )
)