Open redirect: BMW USA
Message contains use of BMW USA's open redirect but the sender is not BMW.
Sublime rule (View on GitHub)
1name: "Open redirect: BMW USA"
2description: |
3 Message contains use of BMW USA's open redirect but the sender is not BMW.
4type: "rule"
5severity: "medium"
6source: |
7 type.inbound
8 and sender.email.domain.root_domain not in~ ('bmw.com', 'bmwusa.com')
9 and any(body.links, .href_url.domain.domain == 't.msg.bmwusa.com' and .href_url.path =~ '/r/')
10attack_types:
11 - "Credential Phishing"
12 - "Malware/Ransomware"
13tactics_and_techniques:
14 - "Open redirect"
15detection_methods:
16 - "Sender analysis"
17 - "URL analysis"
18id: "1bf4e69a-1762-5168-8dc9-c5d3d0d4a181"