Open Redirect: magic4media.com
Message contains use of the magic4media.com open redirect. This has been exploited in the wild.
Sublime rule (View on GitHub)
1name: "Open Redirect: magic4media.com"
2description: |
3 Message contains use of the magic4media.com open redirect. This has been exploited in the wild.
4type: "rule"
5severity: "medium"
6source: |
7 type.inbound
8 and any(body.links,
9 .href_url.domain.root_domain == "magic4media.com"
10 and strings.icontains(.href_url.query_params, 'r=')
11 and not strings.icontains(.href_url.query_params,
12 'r=(?:https?(?:%3a|:))?(?:%2f|\/){2}[^&]*magic4media\.com(?:\&|\/|$)'
13 )
14 )
15 // remove uses that originate from magic4media.com
16 and not any(headers.domains, .root_domain == "magic4media.com")
17 // negate highly trusted sender domains unless they fail DMARC authentication
18 and (
19 (
20 sender.email.domain.root_domain in $high_trust_sender_root_domains
21 and not headers.auth_summary.dmarc.pass
22 )
23 or sender.email.domain.root_domain not in $high_trust_sender_root_domains
24 )
25attack_types:
26 - "Credential Phishing"
27 - "Malware/Ransomware"
28tactics_and_techniques:
29 - "Open redirect"
30detection_methods:
31 - "Sender analysis"
32 - "URL analysis"
33id: "942ebfa5-b119-554e-ac88-e5d91400e51a"