Detection rules › Sublime MQL
Link: Multistage landing - Trello board abuse
Detects suspicious Trello board links containing malicious indicators such as credential theft content, blocked users, malicious attachments, or boards with minimal content from unsolicited senders.
Threat classification
Sublime's own taxonomy (not MITRE ATT&CK).
| Category | Values |
|---|---|
| Attack types | Credential Phishing |
| Tactics and techniques | Free file host, Social engineering |
Event coverage
| Message attribute |
|---|
| body |
| body.links (collection) |
| type |
Rule body MQL
type.inbound
and any(filter(body.links,
.href_url.domain.root_domain == "trello.com"
and strings.istarts_with(.href_url.path, "/b/")
),
// avoid doing LinkAnalysis if the display-text has strong indications of phishing
(
// replace confusables - observed ITW
regex.icontains(strings.replace_confusables(.display_text),
'review|proposal|document|efax|restore|[o0]pen|secure|messaging|reset|account|verify|login|notification|alert|urgent|immediate|access|support|\bupdate\b|download|attachment|service|payment|remittance|invoice|rfp|rfi|pdf|doc'
)
and not regex.icontains(strings.replace_confusables(.display_text),
'customer service'
)
// add confidence to these strings by using profile.by_sender()
and (
not profile.by_sender_email().solicited
and profile.by_sender_email().prevalence in ('new', 'outlier')
)
)
or any(ml.link_analysis(.).additional_responses,
// less than 4 cards on the Trello board
length(.json['cards']) < 4
or any(.json['cards'],
// suspicious link in a card title
(
strings.parse_url(.['name']).domain.valid
and (
ml.link_analysis(strings.parse_url(.['name'])).credphish.disposition == "phishing"
or ml.link_analysis(strings.parse_url(.['name'])).credphish.contains_captcha
// CF Turnstile
or any(ml.link_analysis(strings.parse_url(.['name'])).unique_urls_accessed,
.domain.domain == "challenges.cloudflare.com"
)
)
)
// Trello detected a malicious card attachment
or .['badges']['maliciousAttachments'] > 0
)
// Trello has blocked the user account
or any(.json['members'], .['activityBlocked'] == true)
// the user is the sole member of their Trello account and is the admin
or (
length(.json['memberships']) == 1
and all(.json['memberships'], .['orgMemberType'] == "admin")
)
)
)
Detection logic
Scope: inbound message.
Detects suspicious Trello board links containing malicious indicators such as credential theft content, blocked users, malicious attachments, or boards with minimal content from unsolicited senders.
- inbound message
any of
filter(body.links)where any holds:all of:
- strings.replace_confusables(.display_text) matches 'review|proposal|document|efax|restore|[o0]pen|secure|messaging|reset|account|verify|login|notification|alert|urgent|immediate|access|support|\\bupdate\\b|download|attachment|service|payment|remittance|invoice|rfp|rfi|pdf|doc'
not:
- strings.replace_confusables(.display_text) matches 'customer service'
all of:
not:
- profile.by_sender_email().solicited
- profile.by_sender_email().prevalence in ('new', 'outlier')
any of
ml.link_analysis(.).additional_responseswhere any holds:- length(.json['cards']) < 4
any of
.json['cards']where any holds:all of:
- strings.parse_url(.['name']).domain.valid
any of:
- ml.link_analysis(strings.parse_url(.['name'])).credphish.disposition is 'phishing'
- ml.link_analysis(strings.parse_url(.['name'])).credphish.contains_captcha
any of
ml.link_analysis(strings.parse_url(.['name'])).unique_urls_accessedwhere:- .domain.domain is 'challenges.cloudflare.com'
- .['badges']['maliciousAttachments'] > 0
any of
.json['members']where:- .['activityBlocked'] is True
all of:
- length(.json['memberships']) is 1
all of
.json['memberships']where:- .['orgMemberType'] is 'admin'
Inspects: body.links, body.links[].href_url.domain.root_domain, body.links[].href_url.path, type.inbound. Sensors: ml.link_analysis, profile.by_sender_email, regex.icontains, strings.istarts_with, strings.parse_url, strings.replace_confusables.
Indicators matched (6)
| Field | Match | Value |
|---|---|---|
body.links[].href_url.domain.root_domain | equals | trello.com |
strings.istarts_with | prefix | /b/ |
regex.icontains | regex | review|proposal|document|efax|restore|[o0]pen|secure|messaging|reset|account|verify|login|notification|alert|urgent|immediate|access|support|\bupdate\b|download|attachment|service|payment|remittance|invoice|rfp|rfi|pdf|doc |
regex.icontains | regex | customer service |
ml.link_analysis(strings.parse_url(ml.link_analysis(filter(body.links)[]).additional_responses[].json['cards'][]['name'])).unique_urls_accessed[].domain.domain | equals | challenges.cloudflare.com |
ml.link_analysis(filter(body.links)[]).additional_responses[].json['memberships'][]['orgMemberType'] | equals | admin |