Open Redirect: plasticsurgery.or.kr
Message contains use of the plasticsurgery.or.kr open redirect. This has been exploited in the wild.
Sublime rule (View on GitHub)
1name: "Open Redirect: plasticsurgery.or.kr"
2description: |
3 Message contains use of the plasticsurgery.or.kr open redirect. This has been exploited in the wild.
4type: "rule"
5severity: "medium"
6source: |
7 type.inbound
8 and any(body.links,
9 .href_url.domain.root_domain == "plasticsurgery.or.kr"
10 and strings.icontains(.href_url.path, '/bbs/link.php')
11 and strings.icontains(.href_url.query_params, 'code=')
12 and strings.icontains(.href_url.query_params, 'url=')
13 and not regex.icontains(.href_url.query_params,
14 'url=(?:https?(?:%3a|:))?(?:%2f|\/){2}[^&]*plasticsurgery\.or\.kr(?:\&|\/|$)'
15 )
16 )
17 and not sender.email.domain.root_domain == "plasticsurgery.or.kr"
18 // negate highly trusted sender domains unless they fail DMARC authentication
19 and (
20 (
21 sender.email.domain.root_domain in $high_trust_sender_root_domains
22 and not headers.auth_summary.dmarc.pass
23 )
24 or sender.email.domain.root_domain not in $high_trust_sender_root_domains
25 )
26attack_types:
27 - "Credential Phishing"
28 - "Malware/Ransomware"
29tactics_and_techniques:
30 - "Open redirect"
31detection_methods:
32 - "Sender analysis"
33 - "URL analysis"
34id: "76dbd946-62d1-527f-b50b-fa4548c002d8"