Detection rules › Sublime MQL

Open redirect (go2.aspx) leading to Microsoft credential phishing

Severity
medium
Type
rule
Source
github.com/sublime-security/sublime-rules

This rule is designed to detect credential phishing attacks that exploit go2.aspx redirects and masquerade as Microsoft-related emails.

Threat classification

Sublime's own taxonomy (not MITRE ATT&CK).

CategoryValues
Attack typesCredential Phishing
Tactics and techniquesImpersonation: Brand, Open redirect

Event coverage

Rule body MQL

type.inbound

// url path ends with go2.aspx
and any(body.links,
        strings.ends_with(.href_url.path, "go2.aspx")

        // query params from href_url or ml.link_analysis contain a redirection string ending with a base64
        // pattern intended to capture an encoded email passed as an additional parameter
        and (
          regex.contains(.href_url.query_params,
                         '[a-z]=[a-z0-9-]+\.[a-z]{2,3}.+[A-Za-z0-9+/=]$|=[^=]$|={3,}$'
          )
          or regex.icontains(ml.link_analysis(.).effective_url.query_params,
                             '[a-z]=[a-z0-9-]+\.[a-z]{2,3}.+[A-Za-z0-9+/=]$|=[^=]$|={3,}$'
          )
        )
)
and headers.mailer is null
and regex.icontains(body.html.inner_text,
                    '(i\x{034F}c\x{034F}r\x{034F}os\x{034F}of\x{034F}|icrosof)|(office|o)\s?365'
)

Detection logic

Scope: inbound message.

This rule is designed to detect credential phishing attacks that exploit go2.aspx redirects and masquerade as Microsoft-related emails.

  1. inbound message
  2. any of body.links where all hold:
    • .href_url.path ends with 'go2.aspx'
    • any of:
      • .href_url.query_params matches '[a-z]=[a-z0-9-]+\\.[a-z]{2,3}.+[A-Za-z0-9+/=]$|=[^=]$|={3,}$'
      • ml.link_analysis(.).effective_url.query_params matches '[a-z]=[a-z0-9-]+\\.[a-z]{2,3}.+[A-Za-z0-9+/=]$|=[^=]$|={3,}$'
  3. headers.mailer is missing
  4. body.html.inner_text matches '(i\\x{034F}c\\x{034F}r\\x{034F}os\\x{034F}of\\x{034F}|icrosof)|(office|o)\\s?365'

Inspects: body.html.inner_text, body.links, body.links[].href_url.path, body.links[].href_url.query_params, headers.mailer, type.inbound. Sensors: ml.link_analysis, regex.contains, regex.icontains, strings.ends_with.

Indicators matched (4)

FieldMatchValue
strings.ends_withsuffixgo2.aspx
regex.containsregex[a-z]=[a-z0-9-]+\.[a-z]{2,3}.+[A-Za-z0-9+/=]$|=[^=]$|={3,}$
regex.icontainsregex[a-z]=[a-z0-9-]+\.[a-z]{2,3}.+[A-Za-z0-9+/=]$|=[^=]$|={3,}$
regex.icontainsregex(i\x{034F}c\x{034F}r\x{034F}os\x{034F}of\x{034F}|icrosof)|(office|o)\s?365