Service abuse: Monday.com infrastructure with phishing intent

  1name: "Service abuse: Monday.com infrastructure with phishing intent"
  2description: "Detects unauthorized use of Monday.com tracking links in messages, attachments, or QR codes from unusual senders who lack proper authentication. Excludes legitimate replies and messages from trusted domains with valid DMARC."
  3type: "rule"
  4severity: "high"
  5source: |
  6  type.inbound
  7  and (
  8    (
  9      length(body.links) < 15
 10      and any(body.links,
 11              .href_url.scheme != "mailto"
 12              and (
 13                'monday_tracker' in .href_url.rewrite.encoders
 14                // link is raw url
 15                or .href_url.domain.domain == "trackingservice.monday.com"
 16              )
 17      )
 18    )
 19    or (
 20      length(attachments) <= 3
 21      and (
 22        any(attachments,
 23            (.file_type in $file_types_images or .file_type == "pdf")
 24            //
 25            // This rule makes use of a beta feature and is subject to change without notice
 26            // using the beta feature in custom rules is not suggested until it has been formally released
 27            //
 28            and any(beta.scan_qr(.).items,
 29                    .type is not null
 30                    and 'monday_tracker' in .url.rewrite.encoders
 31                    and .url.scheme != "mailto"
 32            )
 33            //
 34            // This rule makes use of a beta feature and is subject to change without notice
 35            // using the beta feature in custom rules is not suggested until it has been formally released
 36            //
 37            // exclude images taken with mobile cameras and screenshots from android
 38            and not any(beta.parse_exif(.).fields,
 39                        .key == "Model"
 40                        or (
 41                          .key == "Software"
 42                          and strings.starts_with(.value, "Android")
 43                        )
 44            )
 45            // exclude images taken with mobile cameras and screenshots from Apple
 46            and not any(beta.parse_exif(.).fields,
 47                        .key == "DeviceManufacturer"
 48                        and .value == "Apple Computer Inc."
 49            )
 50        )
 51      )
 52    )
 53    or (
 54      length(attachments) == 0
 55      and (
 56        //
 57        // This rule makes use of a beta feature and is subject to change without notice
 58        // using the beta feature in custom rules is not suggested until it has been formally released
 59        //
 60        beta.parse_exif(file.message_screenshot()).image_height < 2000
 61        and beta.parse_exif(file.message_screenshot()).image_width < 2000
 62        and beta.scan_qr(file.message_screenshot()).found
 63        and any(beta.scan_qr(file.message_screenshot()).items,
 64                .type is not null
 65                and 'monday_tracker' in .url.rewrite.encoders
 66                and .url.scheme != "mailto"
 67        )
 68      )
 69    )
 70    or (
 71      length(attachments) <= 3
 72      and (
 73        any(attachments,
 74            (
 75              .file_type in ("pdf")
 76              or .file_extension in ("pdf", "eml")
 77              or .file_extension in $file_extensions_macros
 78              or .content_type in ("message/rfc822")
 79            )
 80            and any(file.explode(.),
 81                    any(.scan.url.urls, 'monday_tracker' in .rewrite.encoders)
 82            )
 83        )
 84      )
 85    )
 86  )
 87  // negate messages that traverse monday.com infra
 88  and not (
 89    any(headers.domains, strings.ends_with(.domain, "mail.monday.com"))
 90    or (
 91      strings.iends_with(headers.message_id, '@monday-mail.com>')
 92      and any(headers.hops,
 93              any(.fields,
 94                  .name =~ "Content-Type"
 95                  and strings.iends_with(.value, 'mondaymailcom_"')
 96              )
 97      )
 98      and any(headers.hops, any(.fields, .name =~ "x-monday-crm"))
 99    )
100  )
101  and not (
102    headers.auth_summary.dmarc.details.from.root_domain == "monday.com"
103    and headers.auth_summary.spf.pass
104    and coalesce(headers.auth_summary.dmarc.pass, false)
105  )
106  and any(ml.nlu_classifier(body.current_thread.text).intents,
107          .name != "benign" and .confidence in ("medium", "high")
108  )
109  // negating legit replies
110  and not (
111    (subject.is_reply or subject.is_forward)
112    and (length(headers.references) > 0 and headers.in_reply_to is not null)
113  )
114  // negate graymail and newsletters
115  and not (
116    any(ml.nlu_classifier(body.current_thread.text).topics,
117        .name in~ (
118          "Advertising and Promotions",
119          "B2B Cold Outreach",
120          "Newsletters and Digests",
121          "Events and Webinars"
122        )
123        and .confidence != "low"
124    )
125  )
126  and (
127    // negate highly trusted sender domains unless they fail DMARC authentication
128    not (
129      sender.email.domain.root_domain in $high_trust_sender_root_domains
130      and coalesce(headers.auth_summary.dmarc.pass, false)
131    )
132    // salesforce has been abused to send phishing campaigns leveraging monday.com infrastructure abuse
133    or sender.email.domain.root_domain in ("salesforce.com")
134  )  
135attack_types:
136  - "Credential Phishing"
137tactics_and_techniques:
138  - "Evasion"
139  - "Social engineering"
140  - "QR code"
141detection_methods:
142  - "Content analysis"
143  - "File analysis"
144  - "Header analysis"
145  - "QR code analysis"
146  - "Sender analysis"
147  - "URL analysis"
148id: "a346e3b1-603e-5ef0-8547-d40ba4282352"