Open redirect: NSF.org

 1name: "Open redirect: NSF.org"
 2description: "Detects inbound messages containing links that abuse the NSF.org (National Sanitation Foundation) redirect functionality via info.nsf.org/Certified/Sustain/sus_pages.asp, where the ProgramURL query parameter points to a domain other than nsf.org. The rule excludes messages from nsf.org senders that pass DMARC authentication, as well as highly trusted sender domains that pass DMARC, to reduce false positives from legitimate NSF communications."
 3type: "rule"
 4severity: "medium"
 5source: |
 6  type.inbound
 7  and any(body.links,
 8          .href_url.domain.domain == "info.nsf.org"
 9          and .href_url.path == "/Certified/Sustain/sus_pages.asp"
10          and length(.href_url.query_params_decoded["ProgramURL"]) > 0
11          // make sure it's not redirecting back to nsf.org
12          and not any(.href_url.query_params_decoded["ProgramURL"],
13                      strings.parse_url(.).domain.root_domain == "nsf.org"
14          )
15  )
16  and not (
17    sender.email.domain.root_domain == "nsf.org"
18    and coalesce(headers.auth_summary.dmarc.pass, false)
19  )
20  // negate highly trusted sender domains unless they fail DMARC authentication
21  and not (
22    sender.email.domain.root_domain in $high_trust_sender_root_domains
23    and coalesce(headers.auth_summary.dmarc.pass, false)
24  )  
25attack_types:
26  - "Credential Phishing"
27tactics_and_techniques:
28  - "Open redirect"
29detection_methods:
30  - "URL analysis"
31  - "Header analysis"
32id: "2b1f1424-a739-5517-80cc-d2443ecc8e0d"