Sublime MQL rules: open

type.inbound
and any(body.links,
        (
          .href_url.domain.domain == "ib.adnxs.com"
          and strings.icontains(.href_url.path, '/getuid')
          // Make sure the redirect is not going back to adnxs.com
          and not regex.icontains(.href_url.query_params,
                                  'getuid\?(?:https?(?:%3a|:))?(?:%2f|\/){2}[^&]*adnxs\.com(?:\&|\/|$|%2f)'
          )
        )
        // second form of an open redirect
        or (
          .href_url.domain.domain == "secure.adnxs.com"
          and strings.icontains(.href_url.query_params, 'redir=')
          // Make sure the redirect is not going back to adnxs.com
          and not regex.icontains(.href_url.query_params,
                                  'redir=(?:https?(?:%3a|:))?(?:%2f|\/){2}[^&]*adnxs\.com(?:\&|\/|$|%2f)'
          )
        )
)
and not sender.email.domain.root_domain == "adnxs.com"
and not sender.email.domain.root_domain == "appnexus.com"

// negate highly trusted sender domains unless they fail DMARC authentication
and (
  (
    sender.email.domain.root_domain in $high_trust_sender_root_domains
    and not headers.auth_summary.dmarc.pass
  )
  or sender.email.domain.root_domain not in $high_trust_sender_root_domains
)

type.inbound
and any(body.links,
        .href_url.domain.root_domain == "agena-smile.com"
        and strings.icontains(.href_url.query_params, 'wptouch_switch=')
        and strings.icontains(.href_url.query_params, 'redirect=')
        and not regex.icontains(.href_url.query_params,
                                'redirect=(?:https?(?:%3a|:))?(?:%2f|\/){2}[^&]*agena-smile\.com(?:\&|\/|$|%2f)'
        )
)
and not sender.email.domain.root_domain == "agena-smile.com"

// negate highly trusted sender domains unless they fail DMARC authentication
and (
  (
    sender.email.domain.root_domain in $high_trust_sender_root_domains
    and not headers.auth_summary.dmarc.pass
  )
  or sender.email.domain.root_domain not in $high_trust_sender_root_domains
)

type.inbound
and any(body.links,
        // Look for website-5 URLs
        .href_url.domain.domain == "api.amaterasu-for-website-5.com"
        and strings.icontains(.href_url.query_params, 'url=')
        // Make sure it's not redirecting back to website-5.com domains
        and not regex.icontains(.href_url.query_params,
                                'url=(?:https?(?:%3a|:))?(?:%2f|\/){2}[^&]*website-5\.com(?:\&|\/|$|%2f)'
        )
)
// Exclude legitimate website-5 domains as senders
and not sender.email.domain.root_domain == "website-5.com"
and not sender.email.domain.root_domain == "amaterasu-for-website-5.com"

// negate highly trusted sender domains unless they fail DMARC authentication
and (
  (
    sender.email.domain.root_domain in $high_trust_sender_root_domains
    and not headers.auth_summary.dmarc.pass
  )
  or sender.email.domain.root_domain not in $high_trust_sender_root_domains
)

type.inbound
// there are less than 10 unique links for api.spently.com within the body.links
and length(distinct(filter(body.links,
                           .href_url.domain.domain == "api.spently.com"
                    ),
                    .href_url.url
           )
) < 10
and any(body.links,
        .href_url.domain.domain == "api.spently.com"
        and strings.istarts_with(.href_url.path, '/api/spently/click')
        and strings.icontains(.href_url.query_params, 'url=')
        and strings.icontains(.href_url.query_params, 'type=')
        and not regex.icontains(.href_url.query_params,
                                'url=(?:https?(?:%3a|:))?(?:%2f|\/){2}[^&]*spently\.com(?:\&|\/|$|%2f)'
        )
)
and not sender.email.domain.root_domain == "spently.com"

// negate highly trusted sender domains unless they fail DMARC authentication
and (
  (
    sender.email.domain.root_domain in $high_trust_sender_root_domains
    and not headers.auth_summary.dmarc.pass
  )
  or sender.email.domain.root_domain not in $high_trust_sender_root_domains
)

type.inbound
and any(body.links,
        .href_url.domain.root_domain == 'artisteer.com'
        and strings.icontains(.href_url.query_params, 'redirect_url=')
        and strings.icontains(.href_url.query_params, 'p=affr')
)
and sender.email.domain.root_domain != 'artisteer.com'

// negate highly trusted sender domains unless they fail DMARC authentication
and (
  (
    sender.email.domain.root_domain in $high_trust_sender_root_domains
    and not headers.auth_summary.dmarc.pass
  )
  or sender.email.domain.root_domain not in $high_trust_sender_root_domains
)

type.inbound
and any(body.links,
        .href_url.domain.root_domain == "artkaderne.dk"
        and strings.icontains(.href_url.query_params, "refurl=")
)
and not sender.email.domain.root_domain == "artkaderne.dk"

// negate highly trusted sender domains unless they fail DMARC authentication
and (
  (
    sender.email.domain.root_domain in $high_trust_sender_root_domains
    and not headers.auth_summary.dmarc.pass
  )
  or sender.email.domain.root_domain not in $high_trust_sender_root_domains
)

type.inbound
and 0 < length(body.links) < 10
and any(body.links,
        .href_url.domain.root_domain == "asemailmgmteu.com"
        and strings.icontains(.href_url.query_params, 'redirect=')
        and .display_text != "unsubscribe"
        // negate use of the redirect by asemailmgmteu.com
        and not any(.href_url.query_params_decoded["redirect"],
                    strings.parse_url(.).domain.root_domain == sender.email.domain.root_domain
                    or strings.parse_url(.).domain.root_domain == "asemailmgmteu.com"
        )
)
// negate highly trusted sender domains unless they fail DMARC authentication
and (
  (
    sender.email.domain.root_domain in $high_trust_sender_root_domains
    and not headers.auth_summary.dmarc.pass
  )
  or sender.email.domain.root_domain not in $high_trust_sender_root_domains
)

type.inbound
and any(body.links,
        .href_url.domain.root_domain == "astroarts.co.jp"
        and strings.istarts_with(.href_url.path, '/oauth/')
        and strings.icontains(.href_url.query_params, 'redirect_uri=')
        and not regex.icontains(.href_url.query_params,
                                'redirect_uri=(?:https?(?:%3a|:))?(?:%2f|\/){2}[^&]*astroarts\.co\.jp(?:\&|\/|$|%2f)'
        )
)
and not sender.email.domain.root_domain == "astroarts.co.jp"

// negate highly trusted sender domains unless they fail DMARC authentication
and (
  (
    sender.email.domain.root_domain in $high_trust_sender_root_domains
    and not headers.auth_summary.dmarc.pass
  )
  or sender.email.domain.root_domain not in $high_trust_sender_root_domains
)

type.inbound
and any(body.links,
        .href_url.domain.domain == 'ad.atdmt.com'
        and strings.ilike(.href_url.path, '*/c*')
)

type.inbound
and any(body.links,
        .href_url.domain.root_domain == "avast.com"
        and strings.contains(.href_url.query_params,
                             "DisplayRedirectCustomPage"
        )
)
and sender.email.domain.root_domain != "avast.com"
and (
  not profile.by_sender().solicited
  or (
    profile.by_sender().any_messages_malicious_or_spam
    and not profile.by_sender().any_messages_benign
  )
)

type.inbound
and any(body.links,
        .href_url.domain.domain == "bananaguide.com"
        and .href_url.path == "/thru.php"
        and length(.href_url.query_params_decoded["url"]) > 0
        // Make sure the redirect is not going back to bananaguide.com
        and not any(.href_url.query_params_decoded["url"],
                    strings.parse_url(.).domain.root_domain == "bananaguide.com"
        )
)
and not sender.email.domain.root_domain == "bananaguide.com"

// negate highly trusted sender domains unless they fail DMARC authentication
and (
  (
    sender.email.domain.root_domain in $high_trust_sender_root_domains
    and not headers.auth_summary.dmarc.pass
  )
  or sender.email.domain.root_domain not in $high_trust_sender_root_domains
)

type.inbound
and any(body.links,
        .href_url.domain.root_domain == "bangkoksync.com"
        and strings.icontains(.href_url.path, '/goto.php')
        and regex.icontains(.href_url.query_params,
                            'url=(?:https?|(?:\/|%2f)(?:\/|%2f))'
        )
        and any(.href_url.query_params_decoded["url"],
                strings.parse_url(.).domain.root_domain != "bangkoksync.com"
        )
)
and not sender.email.domain.root_domain == "bangkoksync.com"

// negate highly trusted sender domains unless they fail DMARC authentication
and (
  (
    sender.email.domain.root_domain in $high_trust_sender_root_domains
    and not headers.auth_summary.dmarc.pass
  )
  or sender.email.domain.root_domain not in $high_trust_sender_root_domains
)

type.inbound
and any(body.links,
        .href_url.domain.root_domain == "bestdeals.today"
        and strings.icontains(.href_url.path, '/redirect')
        and regex.icontains(.href_url.query_params, '(?:^|&)url=')
)
and sender.email.domain.root_domain != 'bestdeals.today'
and headers.return_path.domain.root_domain != "bestdeals.today"

// negate highly trusted sender domains unless they fail DMARC authentication
and (
  (
    sender.email.domain.root_domain in $high_trust_sender_root_domains
    and not headers.auth_summary.dmarc.pass
  )
  or sender.email.domain.root_domain not in $high_trust_sender_root_domains
)

type.inbound
and any(body.links,
        strings.istarts_with(.href_url.path, '/bitrix/')
        and strings.iends_with(.href_url.path, '.php')
        and strings.icontains(.href_url.query_params, 'goto=')
)

// negate highly trusted sender domains unless they fail DMARC authentication
and (
  (
    sender.email.domain.root_domain in $high_trust_sender_root_domains
    and not headers.auth_summary.dmarc.pass
  )
  or sender.email.domain.root_domain not in $high_trust_sender_root_domains
)

type.inbound
and sender.email.domain.root_domain not in~ ('bmw.com', 'bmwusa.com')
and any(body.links,
        .href_url.domain.domain == 't.msg.bmwusa.com'
        and .href_url.path =~ '/r/'
)

type.inbound
and any(body.links,
        .href_url.domain.root_domain == "bubblelife.com"
        and strings.istarts_with(.href_url.path, '/click/')
        and strings.icontains(.href_url.query_params, 'url=')
        and not regex.icontains(.href_url.query_params,
                                'url=(?:https?(?:%3a|:))?(?:%2f|\/){2}[^&]*bubblelife\.com(?:\&|\/|$|%2f)'
        )
)
// remove uses that originate from bubblelife.com
and not any(headers.domains, .root_domain == "bubblelife.com")
// negate highly trusted sender domains unless they fail DMARC authentication
and (
  (
    sender.email.domain.root_domain in $high_trust_sender_root_domains
    and not headers.auth_summary.dmarc.pass
  )
  or sender.email.domain.root_domain not in $high_trust_sender_root_domains
)

type.inbound
and any(body.links,
        // Look for buildingengines URLs
        .href_url.domain.domain == "app.buildingengines.com"
        and strings.icontains(.href_url.query_params, '_redirectTo=')
        // Make sure it's not redirecting back to buildingengines.com
        and not regex.icontains(.href_url.query_params,
                                '_redirectTo=(?:https?(?:%3a|:))?(?:%2f|\/){2}[^&]*buildingengines\.com(?:\&|\/|$|%2f)'
        )
)
// Exclude legitimate Building Engines domains as senders
and not sender.email.domain.root_domain == "buildingengines.com"

// negate highly trusted sender domains unless they fail DMARC authentication
and (
  (
    sender.email.domain.root_domain in $high_trust_sender_root_domains
    and not headers.auth_summary.dmarc.pass
  )
  or sender.email.domain.root_domain not in $high_trust_sender_root_domains
)

type.inbound
and any(body.links,
        .href_url.domain.domain == "business.google.com"
        and strings.icontains(.href_url.path, '/website_shared/launch_bw.html')
        and strings.icontains(.href_url.query_params, 'f=')
        // Make sure the redirect is not going back to google.com
        and not regex.icontains(.href_url.query_params,
                                'f=(?:https?(?:%3a|:))?(?:%2f|\/){2}[^&]*google\.com(?:\&|\/|$|%2f)'
        )
)
// Exclude legitimate Google domains as senders
and not regex.icontains(sender.email.domain.root_domain, '^google')

// negate highly trusted sender domains unless they fail DMARC authentication
and (
  (
    sender.email.domain.root_domain in $high_trust_sender_root_domains
    and not headers.auth_summary.dmarc.pass
  )
  or sender.email.domain.root_domain not in $high_trust_sender_root_domains
)

type.inbound
and any(body.links,
        .href_url.domain.sld == 'cartoonnetwork'
        // it has to be www. - not hitting the www doesn't work
        and .href_url.domain.subdomain == 'www'
        // the path startswith a double //
        and strings.starts_with(.href_url.path, '//')
        // the path has to end in a trailing /
        and strings.ends_with(.href_url.path, '/')
)

type.inbound
and any(body.links,
        .href_url.domain.root_domain == 'chkc.com.hk'
        and strings.icontains(.href_url.path, 'ViewSwitcher/SwitchView')
        and strings.icontains(.href_url.query_params, 'returnUrl=')
)

// negate highly trusted sender domains unless they fail DMARC authentication
and (
  (
    sender.email.domain.root_domain in $high_trust_sender_root_domains
    and not headers.auth_summary.dmarc.pass
  )
  or sender.email.domain.root_domain not in $high_trust_sender_root_domains
)

type.inbound
and any(body.links,
        .href_url.domain.root_domain == 'calgary.ca'
        and .href_url.path =~ '/_layouts/cocis/DirectDownload.aspx'
        and strings.icontains(.href_url.query_params, "redirect")
)
and sender.email.domain.root_domain != 'calgary.ca'

// negate highly trusted sender domains unless they fail DMARC authentication
and (
  (
    sender.email.domain.root_domain in $high_trust_sender_root_domains
    and not headers.auth_summary.dmarc.pass
  )
  or sender.email.domain.root_domain not in $high_trust_sender_root_domains
)

type.inbound
and any(body.links,
        .href_url.domain.root_domain == "club-os.com"
        and strings.icontains(.href_url.path, 'click')
        and strings.icontains(.href_url.query_params, 'target=')
        // negate hash lookup targets (not actor controlled)
        and not (
          regex.icontains(.href_url.query_params, 'target=[a-f0-9]{40}(?:$|&)')
          and strings.icontains(.href_url.query_params, '&hashLookup=true')
        )
        // negate urls that go back to club-os
        and not regex.icontains(.href_url.query_params,
                                'target=[^\&]*club-os.com/'
        )
)

// negate highly trusted sender domains unless they fail DMARC authentication
and (
  (
    sender.email.domain.root_domain in $high_trust_sender_root_domains
    and not headers.auth_summary.dmarc.pass
  )
  or sender.email.domain.root_domain not in $high_trust_sender_root_domains
)

type.inbound
// convertcart is used in benign messages, however, they commonly have many links
// ensure messages contain less than 10 links convertcart.com to ensure higher fidelity matching of malicious messages
and length(filter(body.links, .href_url.domain.root_domain == "convertcart.com")
) < 10
and any(body.links,
        .href_url.domain.root_domain == "convertcart.com"
        and strings.iends_with(.href_url.path, '/click')
        and strings.icontains(.href_url.query_params, 'url=')
        and not regex.icontains(.href_url.query_params,
                                'url=(?:https?(?:%3a|:))?(?:%2f|\/){2}[^&]*convertcart\.com(?:\&|\/|$|%2f)'
        )
        and not strings.icontains(.href_url.query_params,
                                  sender.email.domain.root_domain
        )
)
// remove uses that originate from convertcart.com
and not any(headers.domains,
            .root_domain in ("convertcart.com", "convertc.com")
)
// negate highly trusted sender domains unless they fail DMARC authentication
and (
  (
    sender.email.domain.root_domain in $high_trust_sender_root_domains
    and not headers.auth_summary.dmarc.pass
  )
  or sender.email.domain.root_domain not in $high_trust_sender_root_domains
)

type.inbound
and any(body.links,
        .href_url.domain.domain == 't.em.home.dell.com'
        and .href_url.path =~ '/r/'
)
and sender.email.domain.root_domain not in ('dell.com', 'dell.ca')

// negate highly trusted sender domains unless they fail DMARC authentication
and (
  (
    sender.email.domain.root_domain in $high_trust_sender_root_domains
    and not headers.auth_summary.dmarc.pass
  )
  or sender.email.domain.root_domain not in $high_trust_sender_root_domains
)

type.inbound
and any(body.links,
        .href_url.domain.root_domain == "designsori.com"
        and strings.icontains(.href_url.path, 'redirect.php')
        and regex.icontains(.href_url.query_params,
                            'url=(?:https?(?:%3a|:))?(?:%2f|\/){2}'
        )
        and not regex.icontains(.href_url.query_params,
                                'url=(?:https?(?:%3a|:))?(?:%2f|\/){2}[^&]*designsori\.com(?:\&|\/|$)'
        )
)
and not sender.email.domain.root_domain == "designsori.com"

// negate highly trusted sender domains unless they fail DMARC authentication
and (
  (
    sender.email.domain.root_domain in $high_trust_sender_root_domains
    and not headers.auth_summary.dmarc.pass
  )
  or sender.email.domain.root_domain not in $high_trust_sender_root_domains
)

type.inbound
and any(body.links,
        .href_url.domain.root_domain == "diesel.az"
        and strings.istarts_with(.href_url.path, '/az/redirect')
        and length(.href_url.query_params_decoded["url"]) > 0
        // redirect is not going back to diesel.az
        and not any(.href_url.query_params_decoded["url"],
                    strings.parse_url(.).domain.root_domain == "diesel.az"
        )
)
and not (
  sender.email.domain.root_domain == "diesel.az"
  and coalesce(headers.auth_summary.dmarc.pass, false)
)