Link: Monday hosted link with suspicious content

 1name: "Link: Monday hosted link with suspicious content"
 2description: "Detects inbound messages containing monday.com hosted links with suspicious content such as secure messages, e-signing, or file sharing."
 3type: "rule"
 4severity: "medium"
 5source: |
 6  type.inbound
 7  // exactly one unique monday.com URL scoped to subdomain hyperlink
 8  and any(body.current_thread.links,
 9          // monday service has been observed encoding mailto links as urls
10          .href_url.scheme != "mailto"
11          // ignore plain text links
12          and .parser != "plain"
13          and .href_url.domain.root_domain == "monday.com"
14          and .href_url.domain.subdomain in ("forms", "view")
15          // negate benign form requests
16          and not regex.icontains(ml.link_analysis(., mode="aggressive").final_dom.raw,
17                                  '\bquestionnaire\b',
18                                  '\bquote\b',
19                                  '\brequest\b',
20                                  '\bwork order\b'
21          )
22  )
23  
24  // suspicious indicators
25  and (
26    any(ml.nlu_classifier(body.current_thread.text).topics,
27        .name == "Secure Message" and .confidence == "high"
28    )
29    or any(ml.nlu_classifier(body.current_thread.text).topics,
30           .name == "E-Signature" and .confidence == "high"
31    )
32  
33    // file share nlu with cred theft indicators
34    or (
35      any(ml.nlu_classifier(body.current_thread.text).topics,
36          .name == "File Sharing and Cloud Services" and .confidence == "high"
37      )
38      and any(ml.nlu_classifier(body.current_thread.text).intents,
39              .name == "cred_theft" and .confidence == "high"
40      )
41    )
42  )
43  
44  // negate legitimate replies
45  and not (
46    (length(headers.references) > 0 or headers.in_reply_to is not null)
47    and (subject.is_forward or subject.is_reply)
48    and length(body.previous_threads) >= 1
49  )
50    
51attack_types:
52  - "Credential Phishing"
53  - "BEC/Fraud"
54tactics_and_techniques:
55  - "Social engineering"
56detection_methods:
57  - "Natural Language Understanding"
58  - "URL analysis"
59  - "Header analysis"
60id: "fd83724d-714b-5192-94a7-9fa560a31291"