Open redirect: queue.swytchbike.com
Message contains use of the queue.swytchbike.com open redirect. This has been exploited in the wild.
Sublime rule (View on GitHub)
1name: "Open redirect: queue.swytchbike.com"
2description: "Message contains use of the queue.swytchbike.com open redirect. This has been exploited in the wild."
3type: "rule"
4severity: "medium"
5source: |
6 type.inbound
7 and any(body.links,
8 .href_url.domain.domain == "queue.swytchbike.com"
9 and strings.icontains(.href_url.path, '/order')
10 and regex.icontains(.href_url.query_params, '(?:^|&)target=')
11 )
12 and sender.email.domain.root_domain != 'swytchbike.com'
13 and headers.return_path.domain.root_domain != "swytchbike.com"
14
15 // negate highly trusted sender domains unless they fail DMARC authentication
16 and (
17 (
18 sender.email.domain.root_domain in $high_trust_sender_root_domains
19 and not headers.auth_summary.dmarc.pass
20 )
21 or sender.email.domain.root_domain not in $high_trust_sender_root_domains
22 )
23
24attack_types:
25 - "Credential Phishing"
26tactics_and_techniques:
27 - "Impersonation: Brand"
28 - "Social engineering"
29 - "Open redirect"
30detection_methods:
31 - "Header analysis"
32 - "URL analysis"
33 - "Sender analysis"
34id: "916003d1-a5e4-5019-a15a-4fe42bbb6c3d"