Open Redirect: Xfinity CMP Redirection to Google AMP

 1name: "Open Redirect: Xfinity CMP Redirection to Google AMP"
 2description: "Detects when non-Xfinity senders abuse Xfinity's CMP redirection service to reach Google AMP pages. The rule specifically looks for targetURL parameters containing Google AMP paths in links from untrusted or previously malicious senders."
 3type: "rule"
 4severity: "medium"
 5source: |
 6  type.inbound
 7  and any(body.links,
 8          .href_url.domain.domain == "cmp.cws.xfinity.com"
 9          and strings.icontains(.href_url.query_params, "&targetURL=")
10          and regex.icontains(.href_url.query_params,
11                              '&targetUrl=(?:https?)?(?:(?:%3a|\:)?(?:\/|%2f){2})?google\.[^\&]*\/+amp\/+s\/+'
12          )
13  )
14  and not sender.email.domain.root_domain in ("xfinity.com", "comcast.net")
15  and (
16    not profile.by_sender().solicited
17    or (
18      profile.by_sender().any_messages_malicious_or_spam
19      and not profile.by_sender().any_false_positives
20    )
21  )
22  
23  // negate highly trusted sender domains unless they fail DMARC authentication
24  and (
25    (
26      sender.email.domain.root_domain in $high_trust_sender_root_domains
27      and not headers.auth_summary.dmarc.pass
28    )
29    or sender.email.domain.root_domain not in $high_trust_sender_root_domains
30  )  
31attack_types:
32  - "Credential Phishing"
33tactics_and_techniques:
34  - "Open redirect"
35  - "Evasion"
36detection_methods:
37  - "Header analysis"
38  - "URL analysis"
39  - "Sender analysis"
40id: "c0805b80-0524-5278-8848-f720d58571c2"