Create monday_infra_abuse.yml

detection-rules/monday_infra_abuse.yml

@@ -0,0 +1,131 @@
+name: "Monday.com link infrastructure abuse"
+description: "Detects unauthorized use of Monday.com tracking links in messages, attachments, or QR codes from unusual senders who lack proper authentication. Excludes legitimate replies and messages from trusted domains with valid DMARC."
+type: "rule"
+severity: "high"
+source: |
+  type.inbound
+  and (
+    (
+      length(body.links) < 15
+      and any(body.links, .href_url.domain.domain == "trackingservice.monday.com")
+    )
+    or (
+      length(attachments) <= 3
+      and (
+        any(attachments,
+            (.file_type in $file_types_images or .file_type == "pdf")
+            and any(file.explode(.),
+                    .scan.qr.type is not null
+                    and .scan.qr.url.domain.domain == "trackingservice.monday.com"
+                    // exclude images taken with mobile cameras and screenshots from android
+                    and not any(.scan.exiftool.fields,
+                                .key == "Model"
+                                or (
+                                  .key == "Software"
+                                  and strings.starts_with(.value, "Android")
+                                )
+                    )
+                    // exclude images taken with mobile cameras and screenshots from Apple
+                    and not any(.scan.exiftool.fields,
+                                .key == "DeviceManufacturer"
+                                and .value == "Apple Computer Inc."
+                    )
+            )
+        )
+        or (
+          length(attachments) == 0
+          and any(file.explode(beta.message_screenshot()),
+                  .scan.exiftool.image_height < 2000
+                  and .scan.exiftool.image_width < 2000
+                  and .scan.qr.type is not null
+                  and .scan.qr.url.domain.domain == "trackingservice.monday.com"
+          )
+        )
+      )
+    )
+    or (
+      length(attachments) <= 3
+      and (
+        any(attachments,
+            (
+              .file_type in ("pdf")
+              or .file_extension in ("pdf", "eml")
+              or .file_extension in $file_extensions_macros
+              or .content_type in ("message/rfc822")
+            )
+            and any(file.explode(.),
+                    any(.scan.url.urls,
+                        .domain.domain == "trackingservice.monday.com"
+                    )
+            )
+        )
+      )
+    )
+  )
+  and not (
+    any(headers.domains, strings.ends_with(.domain, "mail.monday.com"))
+    or (
+      headers.auth_summary.dmarc.details.from.root_domain == "monday.com"
+      and headers.auth_summary.spf.pass
+      and headers.auth_summary.dmarc.pass
+    )
+  )
+  // negating legit replies
+  and not (
+    (
+      strings.istarts_with(subject.subject, "RE:")
+      or strings.istarts_with(subject.subject, "FW:")
+      or strings.istarts_with(subject.subject, "FWD:")
+      or strings.istarts_with(subject.subject, "Automatic reply:")
+    )
+    and (
+      length(headers.references) > 0
+      and any(headers.hops, any(.fields, strings.ilike(.name, "In-Reply-To")))
+    )
+  )
+  // negate graymail and newsletters with a benign NLU intent
+  and not (
+    any(ml.nlu_classifier(body.current_thread.text).topics,
+        .name in~ (
+          "Advertising and Promotions",
+          "B2B Cold Outreach",
+          "Newsletters and Digests",
+          "Events and Webinars"
+        )
+        and .confidence == "high"
+    )
+    and any(ml.nlu_classifier(body.current_thread.text).intents,
+            .name == "benign" and .confidence == "high"
+    )
+  )
+
+  // negate highly trusted sender domains unless they fail DMARC authentication
+  and (
+    (
+      (
+        (
+          sender.email.domain.root_domain in $high_trust_sender_root_domains
+          and not headers.auth_summary.dmarc.pass
+        )
+        or sender.email.domain.root_domain not in $high_trust_sender_root_domains
+      )
+      and profile.by_sender().prevalence in ("new", "outlier", "rare")
+    )
+    // salesforce has been abused to send phishing campaigns leveraging monday.com infrastructure abuse 
+    or sender.email.domain.root_domain == "salesforce.com"
+  )  
+
+attack_types:
+  - "Credential Phishing"
+tactics_and_techniques:
+  - "Evasion"
+  - "Social engineering"
+  - "QR code"
+detection_methods:
+  - "Content analysis"
+  - "File analysis"
+  - "Header analysis"
+  - "QR code analysis"
+  - "Sender analysis"
+  - "URL analysis"
+id: "a346e3b1-603e-5ef0-8547-d40ba4282352"