Open redirect: Kelkoo Group

 1name: "Open redirect: Kelkoo Group"
 2description: "Detects inbound messages containing links that leverage kelkoogroup.net's redirect functionality to send recipients to an external domain outside of kelkoogroup.net. The rule excludes messages where the sender's domain is kelkoogroup.net and passes DMARC authentication, as well as messages from other highly trusted sender domains that pass DMARC, reducing false positives from legitimate use of the redirect service."
 3type: "rule"
 4severity: "medium"
 5source: |
 6  type.inbound
 7  and any(body.links,
 8          .href_url.domain.root_domain == 'kelkoogroup.net'
 9          and strings.icontains(.href_url.path, '/redirect')
10          and length(.href_url.query_params_decoded['url']) > 0
11          and any(.href_url.query_params_decoded['url'],
12                  strings.parse_url(.).domain.root_domain != 'kelkoogroup.net'
13          )
14  )
15  and not (
16    sender.email.domain.root_domain == "kelkoogroup.net"
17    and coalesce(headers.auth_summary.dmarc.pass, false)
18  )
19  // negate highly trusted sender domains unless they fail DMARC authentication
20  and not (
21    sender.email.domain.root_domain in $high_trust_sender_root_domains
22    and coalesce(headers.auth_summary.dmarc.pass, false)
23  )  
24attack_types:
25  - "Credential Phishing"
26  - "Spam"
27tactics_and_techniques:
28  - "Open redirect"
29detection_methods:
30  - "URL analysis"
31  - "Header analysis"
32  - "Sender analysis"
33id: "2c16fc8a-9678-5ec0-b487-7b765b2acd9c"