Open redirect: YouTube

 1name: "Open redirect: YouTube"
 2description: |
 3    Looks for use of the YouTube open redirect coming from someone other than YouTube.
 4type: "rule"
 5severity: "medium"
 6authors:
 7  - twitter: "vector_sec"
 8source: |
 9  type.inbound
10  and (
11    any(body.links,
12        .href_url.domain.sld == "youtube"
13        and (
14          strings.icontains(.href_url.url, "attribution_link?")
15          or .href_url.path == "/redirect"
16        )
17    )
18    or any(attachments,
19           (
20             .file_extension in~ $file_extensions_macros
21             or .file_extension in~ $file_extensions_common_archives
22             or (
23               .file_extension is null
24               and .file_type == "unknown"
25               and .content_type == "application/octet-stream"
26               and .size < 100000000
27             )
28           )
29           and any(file.oletools(.).relationships,
30                   .name == "hyperlink"
31                   and .target_url.domain.sld == "youtube"
32                   and (
33                     strings.icontains(.target_url.path, "attribution_link?")
34                     or .target_url.path == "/redirect"
35                   )
36           )
37    )
38  )
39  and headers.auth_summary.dmarc.details.from.root_domain == "youtube.com"
40  
41  // negate highly trusted sender domains unless they fail DMARC authentication
42  and not (
43    sender.email.domain.root_domain in $high_trust_sender_root_domains
44    and coalesce(headers.auth_summary.dmarc.pass, false)
45  )
46  and (
47    not profile.by_sender().solicited
48    or profile.by_sender().any_messages_malicious_or_spam
49  )  
50
51tags:
52  - "Attack surface reduction"
53attack_types:
54  - "Credential Phishing"
55  - "Malware/Ransomware"
56tactics_and_techniques:
57  - "Open redirect"
58detection_methods:
59  - "Sender analysis"
60  - "URL analysis"
61id: "fb33bffe-d3db-5acb-ae19-5ddc6b5b0b01"