Detection rules › Sublime MQL
Open redirect: Hakumonkai.org
Detects inbound messages containing links or attachments with URLs that utilize the hakumonkai.org domain's redirect functionality (/fukkou/ref.php) to redirect users to external domains through the 'url' parameter.
Threat classification
Sublime's own taxonomy (not MITRE ATT&CK).
| Category | Values |
|---|---|
| Attack types | Credential Phishing |
| Tactics and techniques | Open redirect |
Event coverage
| Message attribute |
|---|
| attachments (collection) |
| body |
| body.links (collection) |
| type |
Rule body MQL
type.inbound
and (
any(body.links,
(
.href_url.domain.root_domain == "hakumonkai.org"
and .href_url.path == "/fukkou/ref.php"
and any(.href_url.query_params_decoded["url"],
strings.parse_url(.).domain.valid
)
)
)
or any(filter(attachments, .file_type == "pdf"),
any(file.explode(.),
any(.scan.url.urls,
(
.domain.root_domain == "hakumonkai.org"
and .path == "/fukkou/ref.php"
and any(.query_params_decoded["url"],
strings.parse_url(.).domain.valid
)
)
)
)
)
)
Detection logic
Scope: inbound message.
Detects inbound messages containing links or attachments with URLs that utilize the hakumonkai.org domain's redirect functionality (/fukkou/ref.php) to redirect users to external domains through the 'url' parameter.
- inbound message
any of:
any of
body.linkswhere all hold:- .href_url.domain.root_domain is 'hakumonkai.org'
- .href_url.path is '/fukkou/ref.php'
any of
.href_url.query_params_decoded['url']where:- strings.parse_url(.).domain.valid
any of
filter(attachments)where:any of
file.explode(.)where:any of
.scan.url.urlswhere all hold:- .domain.root_domain is 'hakumonkai.org'
- .path is '/fukkou/ref.php'
any of
.query_params_decoded['url']where:- strings.parse_url(.).domain.valid
Inspects: attachments[].file_type, body.links, body.links[].href_url.domain.root_domain, body.links[].href_url.path, body.links[].href_url.query_params_decoded['url'], type.inbound. Sensors: file.explode, strings.parse_url.
Indicators matched (5)
| Field | Match | Value |
|---|---|---|
body.links[].href_url.domain.root_domain | equals | hakumonkai.org |
body.links[].href_url.path | equals | /fukkou/ref.php |
attachments[].file_type | equals | pdf |
file.explode(filter(attachments)[])[].scan.url.urls[].domain.root_domain | equals | hakumonkai.org |
file.explode(filter(attachments)[])[].scan.url.urls[].path | equals | /fukkou/ref.php |