From 277b0638210ffc5668399c78bdba480eb9a26b87 Mon Sep 17 00:00:00 2001 From: Sublime Rule Testing Bot Date: Thu, 23 Jan 2025 03:18:24 +0000 Subject: [PATCH] Sync from PR#2327 Create open_redirect_smartadserver.yml by @zoomequipd https://github.com/sublime-security/sublime-rules/pull/2327 Source SHA 96521975583335deba00080137e1a05e44262e9f Triggered by @zoomequipd --- .../open_redirect_smartadserver.yml | 35 +++++++++++++++++++ 1 file changed, 35 insertions(+) create mode 100644 detection-rules/open_redirect_smartadserver.yml diff --git a/detection-rules/open_redirect_smartadserver.yml b/detection-rules/open_redirect_smartadserver.yml new file mode 100644 index 00000000000..16486df5c9a --- /dev/null +++ b/detection-rules/open_redirect_smartadserver.yml @@ -0,0 +1,35 @@ +name: "Open Redirect: smartadserver.com" +description: | + Message contains use of the smartadserver.com redirect. This has been exploited in the wild. +type: "rule" +severity: "medium" +source: | + type.inbound + and any(body.links, + .href_url.domain.root_domain == "smartadserver.com" + and strings.icontains(.href_url.query_params, 'go=') + and not strings.icontains(.href_url.query_params, + 'go=https?(?:%3a|:)(?:%2f|\/){2}(?:[^\/]+)?smartadserver.com\/' + ) + ) + // remove uses that originate from smartadserver.com + and not any(headers.domains, .root_domain == "smartadserver.com") + // negate highly trusted sender domains unless they fail DMARC authentication + and ( + ( + sender.email.domain.root_domain in $high_trust_sender_root_domains + and not headers.auth_summary.dmarc.pass + ) + or sender.email.domain.root_domain not in $high_trust_sender_root_domains + ) +attack_types: + - "Credential Phishing" + - "Malware/Ransomware" +tactics_and_techniques: + - "Open redirect" +detection_methods: + - "Sender analysis" + - "URL analysis" +id: "27e5a585-891d-549d-af34-e2b8dff6d64e" +testing_pr: 2327 +testing_sha: 96521975583335deba00080137e1a05e44262e9f