Open Redirect: k-mil.net
Message contains use of the k-mil.net open redirect. This has been exploited in the wild.
Sublime rule (View on GitHub)
1name: "Open Redirect: k-mil.net"
2description: |
3 Message contains use of the k-mil.net open redirect. This has been exploited in the wild.
4type: "rule"
5severity: "medium"
6source: |
7 type.inbound
8 and any(body.links,
9 .href_url.domain.root_domain == "k-mil.net"
10 and strings.iends_with(.href_url.path, 'official_url')
11 and strings.icontains(.href_url.query_params, 'u=')
12 and not regex.icontains(.href_url.query_params,
13 'u=(?:https?(?:%3a|:))?(?:%2f|\/){2}[^&]*k-mil\.net(?:\&|\/|$)'
14 )
15 )
16 and not sender.email.domain.root_domain == "k-mil.net"
17 // negate highly trusted sender domains unless they fail DMARC authentication
18 and (
19 (
20 sender.email.domain.root_domain in $high_trust_sender_root_domains
21 and not headers.auth_summary.dmarc.pass
22 )
23 or sender.email.domain.root_domain not in $high_trust_sender_root_domains
24 )
25attack_types:
26 - "Credential Phishing"
27 - "Malware/Ransomware"
28tactics_and_techniques:
29 - "Open redirect"
30detection_methods:
31 - "Sender analysis"
32 - "URL analysis"
33id: "9f422356-1ee1-5135-9132-a45cf14c802e"