Detection rules › Sublime MQL
Open redirect: adnxs.com
Message contains use of the adnxs.com redirect with getuid parameter. This has been exploited in phishing campaigns to redirect users to malicious sites.
Threat classification
Sublime's own taxonomy (not MITRE ATT&CK).
| Category | Values |
|---|---|
| Attack types | Credential Phishing, Malware/Ransomware |
| Tactics and techniques | Open redirect |
Event coverage
| Message attribute |
|---|
| body |
| body.links (collection) |
| headers.auth_summary |
| sender.email |
| type |
Rule body MQL
type.inbound
and any(body.links,
(
.href_url.domain.domain == "ib.adnxs.com"
and strings.icontains(.href_url.path, '/getuid')
// Make sure the redirect is not going back to adnxs.com
and not regex.icontains(.href_url.query_params,
'getuid\?(?:https?(?:%3a|:))?(?:%2f|\/){2}[^&]*adnxs\.com(?:\&|\/|$|%2f)'
)
)
// second form of an open redirect
or (
.href_url.domain.domain == "secure.adnxs.com"
and strings.icontains(.href_url.query_params, 'redir=')
// Make sure the redirect is not going back to adnxs.com
and not regex.icontains(.href_url.query_params,
'redir=(?:https?(?:%3a|:))?(?:%2f|\/){2}[^&]*adnxs\.com(?:\&|\/|$|%2f)'
)
)
)
and not sender.email.domain.root_domain == "adnxs.com"
and not sender.email.domain.root_domain == "appnexus.com"
// negate highly trusted sender domains unless they fail DMARC authentication
and (
(
sender.email.domain.root_domain in $high_trust_sender_root_domains
and not headers.auth_summary.dmarc.pass
)
or sender.email.domain.root_domain not in $high_trust_sender_root_domains
)
Detection logic
Scope: inbound message.
Message contains use of the adnxs.com redirect with getuid parameter. This has been exploited in phishing campaigns to redirect users to malicious sites.
- inbound message
any of
body.linkswhere any holds:all of:
- .href_url.domain.domain is 'ib.adnxs.com'
- .href_url.path contains '/getuid'
not:
- .href_url.query_params matches 'getuid\\?(?:https?(?:%3a|:))?(?:%2f|\\/){2}[^&]*adnxs\\.com(?:\\&|\\/|$|%2f)'
all of:
- .href_url.domain.domain is 'secure.adnxs.com'
- .href_url.query_params contains 'redir='
not:
- .href_url.query_params matches 'redir=(?:https?(?:%3a|:))?(?:%2f|\\/){2}[^&]*adnxs\\.com(?:\\&|\\/|$|%2f)'
not:
- sender.email.domain.root_domain is 'adnxs.com'
not:
- sender.email.domain.root_domain is 'appnexus.com'
any of:
all of:
- sender.email.domain.root_domain in $high_trust_sender_root_domains
not:
- headers.auth_summary.dmarc.pass
- sender.email.domain.root_domain not in $high_trust_sender_root_domains
Inspects: body.links, body.links[].href_url.domain.domain, body.links[].href_url.path, body.links[].href_url.query_params, headers.auth_summary.dmarc.pass, sender.email.domain.root_domain, type.inbound. Sensors: regex.icontains, strings.icontains. Reference lists: $high_trust_sender_root_domains.
Indicators matched (8)
| Field | Match | Value |
|---|---|---|
body.links[].href_url.domain.domain | equals | ib.adnxs.com |
strings.icontains | substring | /getuid |
regex.icontains | regex | getuid\?(?:https?(?:%3a|:))?(?:%2f|\/){2}[^&]*adnxs\.com(?:\&|\/|$|%2f) |
body.links[].href_url.domain.domain | equals | secure.adnxs.com |
strings.icontains | substring | redir= |
regex.icontains | regex | redir=(?:https?(?:%3a|:))?(?:%2f|\/){2}[^&]*adnxs\.com(?:\&|\/|$|%2f) |
sender.email.domain.root_domain | equals | adnxs.com |
sender.email.domain.root_domain | equals | appnexus.com |