Open redirect: Xfinity CMP Redirection to Google AMP

 1name: "Open redirect: Xfinity CMP Redirection to Google AMP"
 2description: "Detects when non-Xfinity senders abuse Xfinity's CMP redirection service to reach Google AMP pages. The rule specifically looks for targetURL parameters containing Google AMP paths in links from untrusted or previously malicious senders."
 3type: "rule"
 4severity: "medium"
 5source: |
 6  type.inbound
 7  and any(body.links,
 8          .href_url.domain.domain == "cmp.cws.xfinity.com"
 9          and strings.icontains(.href_url.query_params, "&targetURL=")
10          and regex.icontains(.href_url.query_params,
11                              '&targetUrl=(?:https?)?(?:(?:%3a|\:)?(?:\/|%2f){2})?google\.[^\&]*\/+amp\/+s\/+'
12          )
13  )
14  and not sender.email.domain.root_domain in ("xfinity.com", "comcast.net")
15  
16  // negate highly trusted sender domains unless they fail DMARC authentication
17  and not (
18    sender.email.domain.root_domain in $high_trust_sender_root_domains
19    and coalesce(headers.auth_summary.dmarc.pass, false)
20  )  
21attack_types:
22  - "Credential Phishing"
23tactics_and_techniques:
24  - "Open redirect"
25  - "Evasion"
26detection_methods:
27  - "Header analysis"
28  - "URL analysis"
29  - "Sender analysis"
30id: "c0805b80-0524-5278-8848-f720d58571c2"