Open redirect: Diesel.az

calendar Jul 14, 2026  ·
Share on: linkedin copy

Detects inbound messages containing links that abuse Diesel.az's open redirect functionality at '/az/redirect', where the 'url' query parameter points to an external domain. The rule flags messages where the sender is not from diesel.az and the redirect destination leads outside of the diesel.az domain.

Sublime rule (View on GitHub)

 1name: "Open redirect: Diesel.az"
 2description: "Detects inbound messages containing links that abuse Diesel.az's open redirect functionality at '/az/redirect', where the 'url' query parameter points to an external domain. The rule flags messages where the sender is not from diesel.az and the redirect destination leads outside of the diesel.az domain."
 3type: "rule"
 4severity: "medium"
 5source: |
 6  type.inbound
 7  and any(body.links,
 8          .href_url.domain.root_domain == "diesel.az"
 9          and strings.istarts_with(.href_url.path, '/az/redirect')
10          and length(.href_url.query_params_decoded["url"]) > 0
11          // redirect is not going back to diesel.az
12          and not any(.href_url.query_params_decoded["url"],
13                      strings.parse_url(.).domain.root_domain == "diesel.az"
14          )
15  )
16  and not (
17    sender.email.domain.root_domain == "diesel.az"
18    and coalesce(headers.auth_summary.dmarc.pass, false)
19  )  
20attack_types:
21  - "Credential Phishing"
22tactics_and_techniques:
23  - "Open redirect"
24  - "Impersonation: Brand"
25detection_methods:
26  - "URL analysis"
27  - "Sender analysis"
28id: "49dfbf9d-2f4e-50dd-ad49-71b40aaad26f"
to-top