Open redirect: City of Calgary
Message contains use of calgary.ca's open redirect but the sender is not the City of Calgary.
Sublime rule (View on GitHub)
1name: "Open redirect: City of Calgary"
2description: "Message contains use of calgary.ca's open redirect but the sender is not the City of Calgary."
3type: "rule"
4severity: "medium"
5source: |
6 type.inbound
7 and any(body.links,
8 .href_url.domain.root_domain == 'calgary.ca'
9 and .href_url.path =~ '/_layouts/cocis/DirectDownload.aspx'
10 and strings.icontains(.href_url.query_params, "redirect")
11 )
12 and sender.email.domain.root_domain != 'calgary.ca'
13
14 // negate highly trusted sender domains unless they fail DMARC authentication
15 and (
16 (
17 sender.email.domain.root_domain in $high_trust_sender_root_domains
18 and not headers.auth_summary.dmarc.pass
19 )
20 or sender.email.domain.root_domain not in $high_trust_sender_root_domains
21 )
22attack_types:
23 - "Credential Phishing"
24tactics_and_techniques:
25 - "Exploit"
26 - "Open redirect"
27 - "Social engineering"
28detection_methods:
29 - "Sender analysis"
30 - "URL analysis"
31id: "00321858-7e21-5886-969b-530a2f023582"