Detection rules › Sublime MQL
Service abuse: Google Tag Manager debug cookie clearing with open redirect potential
Detects messages containing links to Google Tag Manager's debug cookie clearing endpoint with suspicious URL parameters that may be exploited for open redirects, or links that have been rewritten through Google Tag Manager encoding methods.
Threat classification
Sublime's own taxonomy (not MITRE ATT&CK).
| Category | Values |
|---|---|
| Attack types | Credential Phishing |
| Tactics and techniques | Open redirect, Service abuse |
Event coverage
| Message attribute |
|---|
| body |
| body.links (collection) |
| type |
Rule body MQL
type.inbound
and any(body.links,
(
.href_url.domain.root_domain == "googletagmanager.com"
and .href_url.path == "/debug/clearcookies"
and any(.href_url.query_params_decoded["url"],
strings.parse_url(.).domain.valid
)
)
or 'google_tag_manager' in .href_url.rewrite.encoders
)
Detection logic
Scope: inbound message.
Detects messages containing links to Google Tag Manager's debug cookie clearing endpoint with suspicious URL parameters that may be exploited for open redirects, or links that have been rewritten through Google Tag Manager encoding methods.
- inbound message
any of
body.linkswhere any holds:all of:
- .href_url.domain.root_domain is 'googletagmanager.com'
- .href_url.path is '/debug/clearcookies'
any of
.href_url.query_params_decoded['url']where:- strings.parse_url(.).domain.valid
- .href_url.rewrite.encoders contains 'google_tag_manager'
Inspects: body.links, body.links[].href_url.domain.root_domain, body.links[].href_url.path, body.links[].href_url.query_params_decoded['url'], body.links[].href_url.rewrite.encoders, type.inbound. Sensors: strings.parse_url.
Indicators matched (3)
| Field | Match | Value |
|---|---|---|
body.links[].href_url.domain.root_domain | equals | googletagmanager.com |
body.links[].href_url.path | equals | /debug/clearcookies |
body.links[].href_url.rewrite.encoders | contains | google_tag_manager |