Detection rules › Sublime MQL

Link: Multistage landing - Trello board abuse

Severity
high
Type
rule
Source
github.com/sublime-security/sublime-rules

Detects suspicious Trello board links containing malicious indicators such as credential theft content, blocked users, malicious attachments, or boards with minimal content from unsolicited senders.

Threat classification

Sublime's own taxonomy (not MITRE ATT&CK).

CategoryValues
Attack typesCredential Phishing
Tactics and techniquesFree file host, Social engineering

Event coverage

Rule body MQL

type.inbound
and any(filter(body.links,
               .href_url.domain.root_domain == "trello.com"
               and strings.istarts_with(.href_url.path, "/b/")
        ),
        // avoid doing LinkAnalysis if the display-text has strong indications of phishing
        (
          // replace confusables - observed ITW
          regex.icontains(strings.replace_confusables(.display_text),
                          'review|proposal|document|efax|restore|[o0]pen|secure|messaging|reset|account|verify|login|notification|alert|urgent|immediate|access|support|\bupdate\b|download|attachment|service|payment|remittance|invoice|rfp|rfi|pdf|doc'
          )
          and not regex.icontains(strings.replace_confusables(.display_text),
                                  'customer service'
          )
          // add confidence to these strings by using profile.by_sender()
          and (
            not profile.by_sender_email().solicited
            and profile.by_sender_email().prevalence in ('new', 'outlier')
          )
        )
        or any(ml.link_analysis(.).additional_responses,
               // less than 4 cards on the Trello board
               length(.json['cards']) < 4
               or any(.json['cards'],
                      // suspicious link in a card title
                      (
                        strings.parse_url(.['name']).domain.valid
                        and (
                          ml.link_analysis(strings.parse_url(.['name'])).credphish.disposition == "phishing"
                          or ml.link_analysis(strings.parse_url(.['name'])).credphish.contains_captcha
                          // CF Turnstile
                          or any(ml.link_analysis(strings.parse_url(.['name'])).unique_urls_accessed,
                                 .domain.domain == "challenges.cloudflare.com"
                          )
                        )
                      )
                      // Trello detected a malicious card attachment
                      or .['badges']['maliciousAttachments'] > 0
               )
               // Trello has blocked the user account
               or any(.json['members'], .['activityBlocked'] == true)
               // the user is the sole member of their Trello account and is the admin
               or (
                 length(.json['memberships']) == 1
                 and all(.json['memberships'], .['orgMemberType'] == "admin")
               )
        )
)

Detection logic

Scope: inbound message.

Detects suspicious Trello board links containing malicious indicators such as credential theft content, blocked users, malicious attachments, or boards with minimal content from unsolicited senders.

  1. inbound message
  2. any of filter(body.links) where any holds:
    • all of:
      • strings.replace_confusables(.display_text) matches 'review|proposal|document|efax|restore|[o0]pen|secure|messaging|reset|account|verify|login|notification|alert|urgent|immediate|access|support|\\bupdate\\b|download|attachment|service|payment|remittance|invoice|rfp|rfi|pdf|doc'
      • not:
        • strings.replace_confusables(.display_text) matches 'customer service'
      • all of:
        • not:
          • profile.by_sender_email().solicited
        • profile.by_sender_email().prevalence in ('new', 'outlier')
    • any of ml.link_analysis(.).additional_responses where any holds:
      • length(.json['cards']) < 4
      • any of .json['cards'] where any holds:
        • all of:
          • strings.parse_url(.['name']).domain.valid
          • any of:
            • ml.link_analysis(strings.parse_url(.['name'])).credphish.disposition is 'phishing'
            • ml.link_analysis(strings.parse_url(.['name'])).credphish.contains_captcha
            • any of ml.link_analysis(strings.parse_url(.['name'])).unique_urls_accessed where:
              • .domain.domain is 'challenges.cloudflare.com'
        • .['badges']['maliciousAttachments'] > 0
      • any of .json['members'] where:
        • .['activityBlocked'] is True
      • all of:
        • length(.json['memberships']) is 1
        • all of .json['memberships'] where:
          • .['orgMemberType'] is 'admin'

Inspects: body.links, body.links[].href_url.domain.root_domain, body.links[].href_url.path, type.inbound. Sensors: ml.link_analysis, profile.by_sender_email, regex.icontains, strings.istarts_with, strings.parse_url, strings.replace_confusables.

Indicators matched (6)

FieldMatchValue
body.links[].href_url.domain.root_domainequalstrello.com
strings.istarts_withprefix/b/
regex.icontainsregexreview|proposal|document|efax|restore|[o0]pen|secure|messaging|reset|account|verify|login|notification|alert|urgent|immediate|access|support|\bupdate\b|download|attachment|service|payment|remittance|invoice|rfp|rfi|pdf|doc
regex.icontainsregexcustomer service
ml.link_analysis(strings.parse_url(ml.link_analysis(filter(body.links)[]).additional_responses[].json['cards'][]['name'])).unique_urls_accessed[].domain.domainequalschallenges.cloudflare.com
ml.link_analysis(filter(body.links)[]).additional_responses[].json['memberships'][]['orgMemberType']equalsadmin