Service abuse: Trello board invitation with VIP impersonation

 1name: "Service abuse: Trello board invitation with VIP impersonation"
 2description: "Detects fraudulent Trello board invitations that impersonate organization VIPs by using organization domain names in board titles and including notes purportedly from legitimate company executives."
 3type: "rule"
 4severity: "medium"
 5source: |
 6  type.inbound
 7  and sender.email.domain.root_domain == "trello.com"
 8  // inspect the hops for two observed patterns
 9  and any(headers.hops,
10          any(.fields,
11              // X-Msys-Api with campaign_id
12              (
13                .name =~ "X-Msys-Api"
14                and strings.icontains(.value, 'campaign_id":"invite_board_')
15              )
16              // X-Atl-Po-Triggerid with trello and invite board
17              or (
18                .name == "Feedback-Id"
19                and strings.icontains(.value, 'trello')
20                and regex.icontains(.value, 'invite[_-]board')
21              )
22          )
23  )
24  
25  // inspect the body for two observed patterns
26  and (
27    // org_sld as the start of the board name with the org_vip as the sender
28    any(html.xpath(body.html, '//h2').nodes,
29        // org vip
30        any($org_vips, strings.icontains(..display_text, .display_name))
31        and (
32          // org sld as the board name
33          any($org_slds,
34              strings.icontains(..display_text,
35                                strings.concat('invited you to their board ', .)
36              )
37          )
38          // extract board owner email, check it's not a known org email
39          or any(regex.iextract(.display_text,
40                                '([a-z0-9._%+-]+@[a-z0-9.-]+\.[a-z]{2,})'
41                 ),
42                 not (
43                   .full_match in $sender_emails
44                   or .full_match in $recipient_emails
45                 )
46          )
47          or strings.replace_confusables(.display_text) != .display_text
48        )
49    )
50    // pattern of the first name ending in `From` after the org_vip display name
51    or any(html.xpath(body.html,
52                      '//div[img[@class="trello-member-avatar"]]/parent::div'
53           ).nodes,
54           strings.starts_with(.display_text, 'A note from ')
55           and strings.iends_with(.display_text, 'From')
56           and any($org_vips, strings.icontains(..display_text, .display_name))
57    )
58  )  
59attack_types:
60  - "Credential Phishing"
61tactics_and_techniques:
62  - "Impersonation: VIP"
63  - "Social engineering"
64detection_methods:
65  - "Content analysis"
66  - "Header analysis"
67  - "HTML analysis"
68  - "Sender analysis"
69id: "fedfc94b-4a33-57e0-a891-1af92aec6ddb"