Open redirect: business.google.com website_shared URL Param

 1name: "Open redirect: business.google.com website_shared URL Param"
 2description: |
 3  Detects messages containing an open redirect in business.google.com's 
 4  website_shared/launch_bw.html endpoint with the 'f' parameter. This has been 
 5  exploited in phishing campaigns to redirect users to malicious sites.  
 6type: "rule"
 7severity: "medium"
 8source: |
 9  type.inbound
10  and any(body.links,
11          .href_url.domain.domain == "business.google.com"
12          and strings.icontains(.href_url.path, '/website_shared/launch_bw.html')
13          and strings.icontains(.href_url.query_params, 'f=')
14          // Make sure the redirect is not going back to google.com
15          and not regex.icontains(.href_url.query_params,
16                                  'f=(?:https?(?:%3a|:))?(?:%2f|\/){2}[^&]*google\.com(?:\&|\/|$|%2f)'
17          )
18  )
19  // Exclude legitimate Google domains as senders
20  and not regex.icontains(sender.email.domain.root_domain, '^google')
21  
22  // negate highly trusted sender domains unless they fail DMARC authentication
23  and (
24    (
25      sender.email.domain.root_domain in $high_trust_sender_root_domains
26      and not headers.auth_summary.dmarc.pass
27    )
28    or sender.email.domain.root_domain not in $high_trust_sender_root_domains
29  )  
30attack_types:
31  - "Credential Phishing"
32  - "Malware/Ransomware"
33tactics_and_techniques:
34  - "Open redirect"
35detection_methods:
36  - "Sender analysis"
37  - "URL analysis"
38id: "f146be73-7200-570e-a033-a28814c5a098"