Detection rules › Sublime MQL

Open redirect: Mailtrack Korea

Severity
medium
Type
rule
Source
github.com/sublime-security/sublime-rules

Detects messages containing links to mailtrack.ksd.or.kr tracking service that redirect to external domains, potentially bypassing security controls through the legitimate Korean mail tracking infrastructure.

Threat classification

Sublime's own taxonomy (not MITRE ATT&CK).

CategoryValues
Attack typesCredential Phishing, BEC/Fraud
Tactics and techniquesOpen redirect, Evasion

Event coverage

Rule body MQL

type.inbound
and any(body.links,
        .href_url.domain.domain == "mailtrack.ksd.or.kr"
        and .href_url.path == "/TMS/tracking"
        and "url" in~ keys(.href_url.query_params_decoded)
        and not any(regex.iextract(.href_url.query_params,
                                   'url=([^&]+)(?:\&|\/|$)'
                    ),
                    strings.parse_url(.groups[0]).domain.root_domain == ..href_url.domain.root_domain
        )
)

Detection logic

Scope: inbound message.

Detects messages containing links to mailtrack.ksd.or.kr tracking service that redirect to external domains, potentially bypassing security controls through the legitimate Korean mail tracking infrastructure.

  1. inbound message
  2. any of body.links where all hold:
    • .href_url.domain.domain is 'mailtrack.ksd.or.kr'
    • .href_url.path is '/TMS/tracking'
    • keys(.href_url.query_params_decoded) contains 'url'
    • not:
      • any of regex.iextract(.href_url.query_params) where:
        • strings.parse_url(.groups[0]).domain.root_domain is .href_url.domain.root_domain

Inspects: body.links, body.links[].href_url.domain.domain, body.links[].href_url.domain.root_domain, body.links[].href_url.path, body.links[].href_url.query_params, body.links[].href_url.query_params_decoded, type.inbound. Sensors: regex.iextract, strings.parse_url.

Indicators matched (4)

FieldMatchValue
body.links[].href_url.domain.domainequalsmailtrack.ksd.or.kr
body.links[].href_url.pathequals/TMS/tracking
keys(body.links[].href_url.query_params_decoded)containsurl
regex.iextractregexurl=([^&]+)(?:\&|\/|$)