Link: Monday hosted link with suspicious content

name: "Link: Monday hosted link with suspicious content"
description: "Detects inbound messages containing monday.com hosted links with suspicious content such as secure messages, e-signing, or file sharing."
type: "rule"
severity: "medium"
source: |
  type.inbound
  // exactly one unique monday.com URL scoped to subdomain hyperlink
  and any(body.current_thread.links,
          // monday service has been observed encoding mailto links as urls
          .href_url.scheme != "mailto"
          // ignore plain text links
          and .parser != "plain"
          and .href_url.domain.root_domain == "monday.com"
          and .href_url.domain.subdomain in ("forms", "view")
          // negate benign form requests
          and not regex.icontains(ml.link_analysis(., mode="aggressive").final_dom.raw,
                                  '\bquestionnaire\b',
                                  '\bquote\b',
                                  '\brequest\b',
                                  '\bwork order\b'
          )
  )
  
  // suspicious indicators
  and (
    any(ml.nlu_classifier(body.current_thread.text).topics,
        .name == "Secure Message" and .confidence == "high"
    )
    or any(ml.nlu_classifier(body.current_thread.text).topics,
           .name == "E-Signature" and .confidence == "high"
    )
  
    // file share nlu with cred theft indicators
    or (
      any(ml.nlu_classifier(body.current_thread.text).topics,
          .name == "File Sharing and Cloud Services" and .confidence == "high"
      )
      and any(ml.nlu_classifier(body.current_thread.text).intents,
              .name == "cred_theft" and .confidence == "high"
      )
    )
  )
  
  // negate legitimate replies
  and not (
    (length(headers.references) > 0 or headers.in_reply_to is not null)
    and (subject.is_forward or subject.is_reply)
    and length(body.previous_threads) >= 1
  )
  
attack_types:
  - "Credential Phishing"
  - "BEC/Fraud"
tactics_and_techniques:
  - "Social engineering"
detection_methods:
  - "Natural Language Understanding"
  - "URL analysis"
  - "Header analysis"
id: "fd83724d-714b-5192-94a7-9fa560a31291"