Open Redirect: predictiveresponse.net
Message contains use of the predictiveresponse.net open redirect. This has been exploited in the wild.
Sublime rule (View on GitHub)
1name: "Open Redirect: predictiveresponse.net"
2description: |
3 Message contains use of the predictiveresponse.net open redirect. This has been exploited in the wild.
4type: "rule"
5severity: "medium"
6source: |
7 type.inbound
8 and any(body.links,
9 .href_url.domain.root_domain == "predictiveresponse.net"
10 and strings.icontains(.href_url.query_params, 'redirect=')
11 and not regex.icontains(.href_url.query_params,
12 'redirect=(?:https?(?:%3a|:))?(?:%2f|\/){2}[^&]*predictiveresponse\.net(?:\&|\/|$)'
13 )
14 )
15 and not sender.email.domain.root_domain == "predictiveresponse.net"
16 // negate use of predictiveresponse infra
17 and not any(headers.domains, .root_domain == "predictiveresponse.net")
18 and not any(headers.hops,
19 any(.fields,
20 .name == "List-Unsubscribe"
21 and strings.iends_with(.value, '@predictiveresponse.net>')
22 )
23 )
24 // negate highly trusted sender domains unless they fail DMARC authentication
25 and (
26 (
27 sender.email.domain.root_domain in $high_trust_sender_root_domains
28 and not headers.auth_summary.dmarc.pass
29 )
30 or sender.email.domain.root_domain not in $high_trust_sender_root_domains
31 )
32attack_types:
33 - "Credential Phishing"
34 - "Malware/Ransomware"
35tactics_and_techniques:
36 - "Open redirect"
37detection_methods:
38 - "Sender analysis"
39 - "URL analysis"
40id: "3474bb1b-8840-53b5-9582-3c9baf1b2d63"