Open redirect: Quickbase

 1name: "Open redirect: Quickbase"
 2description: "Detects inbound emails containing links to quickbase.com that use an API parameter alongside a redirect parameter (rdr=) pointing to a destination outside of quickbase.com, indicating potential abuse of Quickbase's redirect functionality to disguise malicious links. The rule excludes emails from quickbase.com or highly trusted sender domains that pass DMARC authentication."
 3type: "rule"
 4severity: "medium"
 5source: |
 6  type.inbound
 7  and any(body.links,
 8          .href_url.domain.root_domain == "quickbase.com"
 9          and strings.icontains(.href_url.query_params, 'a=API_')
10          and strings.icontains(.href_url.query_params, 'rdr=')
11          // make sure it's not redirecting back to quickbase.com
12          and not regex.icontains(.href_url.query_params,
13                                  'rdr=(?:https?(?:%3a|:))?(?:%2f|\/)*[^&]*quickbase\.com(?:&|\/|$|%2f)'
14          )
15  )
16  and not (
17    sender.email.domain.root_domain == "quickbase.com"
18    and coalesce(headers.auth_summary.dmarc.pass, false)
19  )
20  // negate highly trusted sender domains unless they fail DMARC authentication
21  and not (
22    sender.email.domain.root_domain in $high_trust_sender_root_domains
23    and coalesce(headers.auth_summary.dmarc.pass, false)
24  )  
25attack_types:
26  - "Credential Phishing"
27tactics_and_techniques:
28  - "Open redirect"
29detection_methods:
30  - "URL analysis"
31  - "Header analysis"
32id: "7506a05c-c74e-50a7-8044-17546913f600"