Service abuse: Monday.com infrastructure with phishing intent

type.inbound
and (
  (
    length(body.links) < 15
    and any(body.links,
            'monday_tracker' in .href_url.rewrite.encoders
            and .href_url.scheme != "mailto"
    )
  )
  or (
    length(attachments) <= 3
    and (
      any(attachments,
          (.file_type in $file_types_images or .file_type == "pdf")
          //
          // This rule makes use of a beta feature and is subject to change without notice
          // using the beta feature in custom rules is not suggested until it has been formally released
          //
          and any(beta.scan_qr(.).items,
                  .type is not null
                  and 'monday_tracker' in .url.rewrite.encoders
                  and .url.scheme != "mailto"
          )
          //
          // This rule makes use of a beta feature and is subject to change without notice
          // using the beta feature in custom rules is not suggested until it has been formally released
          //
          // exclude images taken with mobile cameras and screenshots from android
          and not any(beta.parse_exif(.).fields,
                      .key == "Model"
                      or (
                        .key == "Software"
                        and strings.starts_with(.value, "Android")
                      )
          )
          // exclude images taken with mobile cameras and screenshots from Apple
          and not any(beta.parse_exif(.).fields,
                      .key == "DeviceManufacturer"
                      and .value == "Apple Computer Inc."
          )
      )
    )
  )
  or (
    length(attachments) == 0
    and (
      //
      // This rule makes use of a beta feature and is subject to change without notice
      // using the beta feature in custom rules is not suggested until it has been formally released
      //
      beta.parse_exif(file.message_screenshot()).image_height < 2000
      and beta.parse_exif(file.message_screenshot()).image_width < 2000
      and beta.scan_qr(file.message_screenshot()).found
      and any(beta.scan_qr(file.message_screenshot()).items,
              .type is not null
              and 'monday_tracker' in .url.rewrite.encoders
              and .url.scheme != "mailto"
      )
    )
  )
  or (
    length(attachments) <= 3
    and (
      any(attachments,
          (
            .file_type in ("pdf")
            or .file_extension in ("pdf", "eml")
            or .file_extension in $file_extensions_macros
            or .content_type in ("message/rfc822")
          )
          and any(file.explode(.),
                  any(.scan.url.urls, 'monday_tracker' in .rewrite.encoders)
          )
      )
    )
  )
)
// negate messages that traverse monday.com infra
and not (
  any(headers.domains, strings.ends_with(.domain, "mail.monday.com"))
  or (
    strings.iends_with(headers.message_id, '@monday-mail.com>')
    and any(headers.hops,
            any(.fields,
                .name =~ "Content-Type"
                and strings.iends_with(.value, 'mondaymailcom_"')
            )
    )
    and any(headers.hops, any(.fields, .name =~ "x-monday-crm"))
  )
)
and not (
  headers.auth_summary.dmarc.details.from.root_domain == "monday.com"
  and headers.auth_summary.spf.pass
  and headers.auth_summary.dmarc.pass
)
and any(ml.nlu_classifier(body.current_thread.text).intents,
        .name != "benign" and .confidence in ("medium", "high")
)
// negating legit replies
and not (
  (subject.is_reply or subject.is_forward)
  and (length(headers.references) > 0 and headers.in_reply_to is not null)
)
// negate graymail and newsletters
and not (
  any(ml.nlu_classifier(body.current_thread.text).topics,
      .name in~ (
        "Advertising and Promotions",
        "B2B Cold Outreach",
        "Newsletters and Digests",
        "Events and Webinars"
      )
      and .confidence != "low"
  )
)
and (
  // negate highly trusted sender domains unless they fail DMARC authentication
  not (
    sender.email.domain.root_domain in $high_trust_sender_root_domains
    and coalesce(headers.auth_summary.dmarc.pass, false)
  )
  // salesforce has been abused to send phishing campaigns leveraging monday.com infrastructure abuse
  or sender.email.domain.root_domain in ("salesforce.com")
)