Open Redirect: business.google.com website_shared URL Param

 1name: "Open Redirect: business.google.com website_shared URL Param"
 2description: |
 3  Detects messages containing an open redirect in business.google.com's 
 4  website_shared/launch_bw.html endpoint with the 'f' parameter. This has been 
 5  exploited in phishing campaigns to redirect users to malicious sites.  
 6type: "rule"
 7severity: "medium"
 8source: |
 9  type.inbound
10  and any(body.links,
11          .href_url.domain.domain == "business.google.com" 
12          and strings.icontains(.href_url.path, '/website_shared/launch_bw.html')
13          and strings.icontains(.href_url.query_params, 'f=')
14          // Make sure the redirect is not going back to google.com
15          and not regex.icontains(.href_url.query_params,
16                                'f=(?:https?(?:%3a|:))?(?:%2f|\/){2}[^&]*google\.com(?:\&|\/|$|%2f)')
17  )
18  // Exclude legitimate Google domains as senders
19  and not regex.icontains(sender.email.domain.root_domain, '^google')
20  
21  // negate highly trusted sender domains unless they fail DMARC authentication
22  and (
23    (
24      sender.email.domain.root_domain in $high_trust_sender_root_domains
25      and not headers.auth_summary.dmarc.pass
26    )
27    or sender.email.domain.root_domain not in $high_trust_sender_root_domains
28  )  
29attack_types:
30  - "Credential Phishing"
31  - "Malware/Ransomware"
32tactics_and_techniques:
33  - "Open redirect"
34detection_methods:
35  - "Sender analysis"
36  - "URL analysis"
37id: "f146be73-7200-570e-a033-a28814c5a098"