Open redirect: EWeb logout redirect

 1name: "Open redirect: EWeb logout redirect"
 2description: "Detects inbound messages containing links to an '/eweb/' logout.aspx page whose redirecturl query parameter points to an off-site domain rather than back to the originating site, indicating abuse of a legitimate logout redirect mechanism. Messages from highly trusted sender domains are excluded unless they fail DMARC authentication."
 3type: "rule"
 4severity: "medium"
 5source: |
 6  type.inbound
 7  and any(body.links,
 8          strings.icontains(.href_url.path, '/eweb/')
 9          and strings.iends_with(.href_url.path, 'logout.aspx')
10          and any(regex.iextract(.href_url.query_params, 'redirecturl=([^&]+)'),
11                  strings.parse_url(.groups[0]).domain.valid
12                  // a legitimate logout returns to the same site; an off-site destination is the abuse
13                  and strings.parse_url(.groups[0]).domain.root_domain != ..href_url.domain.root_domain
14          )
15  )
16  
17  // negate highly trusted sender domains unless they fail DMARC authentication
18  and not (
19    sender.email.domain.root_domain in $high_trust_sender_root_domains
20    and coalesce(headers.auth_summary.dmarc.pass, false)
21  )  
22attack_types:
23  - "Credential Phishing"
24tactics_and_techniques:
25  - "Open redirect"
26detection_methods:
27  - "URL analysis"
28  - "Header analysis"
29id: "46f08e9f-6d85-52ef-8f33-857feaa493da"