detection.wiki

Detection rules › Sublime MQL

Open redirect: Linkedin

Severity
medium
Type
rule
Source
github.com/sublime-security/sublime-rules

Detects emails containing links using Linkedin '/slink?code=xxxxx' open redirect where the email has not come from Linkedin.com

Threat classification

Sublime's own taxonomy (not MITRE ATT&CK).

CategoryValues
Attack typesCredential Phishing, Malware/Ransomware
Tactics and techniquesOpen redirect

Event coverage

Message attribute
attachments (collection)
body
body.links (collection)
sender.email
type

Rule body MQL

type.inbound
and (
  (
    sender.email.domain.root_domain != "linkedin.com"
    and (
      (
        any(body.links,
            .href_url.domain.root_domain == 'linkedin.com'
            and .href_url.path == '/slink'
        )
        and any(body.links, strings.ilike(.href_url.query_params, 'code=*'))
      )
      or any(body.links,
             .href_url.domain.root_domain == 'linkedin.com'
             and strings.icontains(.href_url.query_params, 'redirect_uri')
      )
    )
  )
  or any(attachments,
         .file_type == "pdf"
         and any(file.explode(.),
                 (
                   any(.scan.url.urls,
                       .domain.root_domain == 'linkedin.com'
                       and .path == '/slink'
                   )
                   and any(.scan.url.urls,
                           strings.ilike(.query_params, 'code=*')
                   )
                 )
                 or any(.scan.url.urls,
                        .domain.root_domain == 'linkedin.com'
                        and strings.icontains(.query_params, 'redirect_uri')
                 )
         )
  )
)

Detection logic

Scope: inbound message.

Detects emails containing links using Linkedin '/slink?code=xxxxx' open redirect where the email has not come from Linkedin.com

  1. inbound message
  2. any of:
    • all of:
      • sender.email.domain.root_domain is not 'linkedin.com'
      • any of:
        • all of:
          • any of body.links where all hold:
            • .href_url.domain.root_domain is 'linkedin.com'
            • .href_url.path is '/slink'
          • any of body.links where:
            • .href_url.query_params matches 'code=*'
        • any of body.links where all hold:
          • .href_url.domain.root_domain is 'linkedin.com'
          • .href_url.query_params contains 'redirect_uri'
    • any of attachments where all hold:
      • .file_type is 'pdf'
      • any of file.explode(.) where any holds:
        • all of:
          • any of .scan.url.urls where all hold:
            • .domain.root_domain is 'linkedin.com'
            • .path is '/slink'
          • any of .scan.url.urls where:
            • .query_params matches 'code=*'
        • any of .scan.url.urls where all hold:
          • .domain.root_domain is 'linkedin.com'
          • .query_params contains 'redirect_uri'

Inspects: attachments[].file_type, body.links, body.links[].href_url.domain.root_domain, body.links[].href_url.path, body.links[].href_url.query_params, sender.email.domain.root_domain, type.inbound. Sensors: file.explode, strings.icontains, strings.ilike.

Indicators matched (7)

FieldMatchValue
body.links[].href_url.domain.root_domainequalslinkedin.com
body.links[].href_url.pathequals/slink
strings.ilikesubstringcode=*
strings.icontainssubstringredirect_uri
attachments[].file_typeequalspdf
file.explode(attachments[])[].scan.url.urls[].domain.root_domainequalslinkedin.com
file.explode(attachments[])[].scan.url.urls[].pathequals/slink