Link: Multistage landing - Trello board abuse

name: "Link: Multistage landing - Trello board abuse"
description: "Detects suspicious Trello board links containing malicious indicators such as credential theft content, blocked users, malicious attachments, or boards with minimal content from unsolicited senders."
type: "rule"
severity: "high"
source: |
  type.inbound
  and any(filter(body.links,
                 .href_url.domain.root_domain == "trello.com"
                 and strings.istarts_with(.href_url.path, "/b/")
          ),
          // avoid doing LinkAnalysis if the display-text has strong indications of phishing
          (
            // replace confusables - observed ITW
            regex.icontains(strings.replace_confusables(.display_text),
                            'review|proposal|document|efax|restore|[o0]pen|secure|messaging|reset|account|verify|login|notification|alert|urgent|immediate|access|support|\bupdate\b|download|attachment|service|payment|remittance|invoice|rfp|rfi|pdf|doc'
            )
            and not regex.icontains(strings.replace_confusables(.display_text),
                                    'customer service'
            )
            // add confidence to these strings by using profile.by_sender()
            and (
              not profile.by_sender_email().solicited
              and profile.by_sender_email().prevalence in ('new', 'outlier')
            )
          )
          or any(ml.link_analysis(.).additional_responses,
                 // make sure we have a valid response first
                 .json is not null
                 and .status_code == 200
                 and (
                   // less than 4 cards on the Trello board
                   (
                     .json['cards'] is not null
                     and (
                       length(.json['cards']) < 4
                       or any(.json['cards'],
                              // suspicious link in a card title
                              (
                                strings.parse_url(.['name']).domain.valid
                                and (
                                  ml.link_analysis(strings.parse_url(.['name'])).credphish.disposition == "phishing"
                                  or ml.link_analysis(strings.parse_url(.['name'])
                                  ).credphish.contains_captcha
                                  // CF Turnstile
                                  or any(ml.link_analysis(strings.parse_url(.['name']
                                                          )
                                         ).unique_urls_accessed,
                                         .domain.domain == "challenges.cloudflare.com"
                                  )
                                )
                              )
                              // Trello detected a malicious card attachment
                              or .['badges']['maliciousAttachments'] > 0
                       )
                     )
                   )
                   // Trello has blocked the user account
                   or any(.json['members'], .['activityBlocked'] == true)
                   // the user is the sole member of their Trello account and is the admin
                   or (
                     length(.json['organization']['memberships']) == 1
                     and all(.json['organization']['memberships'],
                             .['memberType'] == "admin"
                     )
                   )
                 )
          )
  )
attack_types:
  - "Credential Phishing"
tactics_and_techniques:
  - "Free file host"
  - "Social engineering"
detection_methods:
  - "URL analysis"
  - "Content analysis"
  - "Sender analysis"
  - "URL screenshot"
id: "14a5b23a-2432-5c58-a3c4-1f0606977dcc"