Link: Multistage landing - Trello board abuse

 1name: "Link: Multistage landing - Trello board abuse"
 2description: "Detects suspicious Trello board links containing malicious indicators such as credential theft content, blocked users, malicious attachments, or boards with minimal content from unsolicited senders."
 3type: "rule"
 4severity: "high"
 5source: |
 6  type.inbound
 7  and any(filter(body.links,
 8                 .href_url.domain.root_domain == "trello.com"
 9                 and strings.istarts_with(.href_url.path, "/b/")
10          ),
11          // avoid doing LinkAnalysis if the display-text has strong indications of phishing
12          (
13            // replace confusables - observed ITW
14            regex.icontains(strings.replace_confusables(.display_text),
15                            'review|proposal|document|efax|restore|[o0]pen|secure|messaging|reset|account|verify|login|notification|alert|urgent|immediate|access|support|\bupdate\b|download|attachment|service|payment|remittance|invoice|rfp|rfi|pdf|doc'
16            )
17            and not regex.icontains(strings.replace_confusables(.display_text),
18                                    'customer service'
19            )
20            // add confidence to these strings by using profile.by_sender()
21            and (
22              not profile.by_sender_email().solicited
23              and profile.by_sender_email().prevalence in ('new', 'outlier')
24            )
25          )
26          or any(ml.link_analysis(.).additional_responses,
27                 // make sure we have a valid response first
28                 .json is not null
29                 and .status_code == 200
30                 and (
31                   // less than 4 cards on the Trello board
32                   (
33                     .json['cards'] is not null
34                     and (
35                       length(.json['cards']) < 4
36                       or any(.json['cards'],
37                              // suspicious link in a card title
38                              (
39                                strings.parse_url(.['name']).domain.valid
40                                and (
41                                  ml.link_analysis(strings.parse_url(.['name'])).credphish.disposition == "phishing"
42                                  or ml.link_analysis(strings.parse_url(.['name'])
43                                  ).credphish.contains_captcha
44                                  // CF Turnstile
45                                  or any(ml.link_analysis(strings.parse_url(.['name']
46                                                          )
47                                         ).unique_urls_accessed,
48                                         .domain.domain == "challenges.cloudflare.com"
49                                  )
50                                )
51                              )
52                              // Trello detected a malicious card attachment
53                              or .['badges']['maliciousAttachments'] > 0
54                       )
55                     )
56                   )
57                   // Trello has blocked the user account
58                   or any(.json['members'], .['activityBlocked'] == true)
59                   // the user is the sole member of their Trello account and is the admin
60                   or (
61                     length(.json['organization']['memberships']) == 1
62                     and all(.json['organization']['memberships'],
63                             .['memberType'] == "admin"
64                     )
65                   )
66                 )
67          )
68  )  
69attack_types:
70  - "Credential Phishing"
71tactics_and_techniques:
72  - "Free file host"
73  - "Social engineering"
74detection_methods:
75  - "URL analysis"
76  - "Content analysis"
77  - "Sender analysis"
78  - "URL screenshot"
79id: "14a5b23a-2432-5c58-a3c4-1f0606977dcc"