Detection rules › Sublime MQL
Open redirect: Mailtrack Korea
Detects messages containing links to mailtrack.ksd.or.kr tracking service that redirect to external domains, potentially bypassing security controls through the legitimate Korean mail tracking infrastructure.
Threat classification
Sublime's own taxonomy (not MITRE ATT&CK).
| Category | Values |
|---|---|
| Attack types | Credential Phishing, BEC/Fraud |
| Tactics and techniques | Open redirect, Evasion |
Event coverage
| Message attribute |
|---|
| body |
| body.links (collection) |
| type |
Rule body MQL
type.inbound
and any(body.links,
.href_url.domain.domain == "mailtrack.ksd.or.kr"
and .href_url.path == "/TMS/tracking"
and "url" in~ keys(.href_url.query_params_decoded)
and not any(regex.iextract(.href_url.query_params,
'url=([^&]+)(?:\&|\/|$)'
),
strings.parse_url(.groups[0]).domain.root_domain == ..href_url.domain.root_domain
)
)
Detection logic
Scope: inbound message.
Detects messages containing links to mailtrack.ksd.or.kr tracking service that redirect to external domains, potentially bypassing security controls through the legitimate Korean mail tracking infrastructure.
- inbound message
any of
body.linkswhere all hold:- .href_url.domain.domain is 'mailtrack.ksd.or.kr'
- .href_url.path is '/TMS/tracking'
- keys(.href_url.query_params_decoded) contains 'url'
not:
any of
regex.iextract(.href_url.query_params)where:- strings.parse_url(.groups[0]).domain.root_domain is .href_url.domain.root_domain
Inspects: body.links, body.links[].href_url.domain.domain, body.links[].href_url.domain.root_domain, body.links[].href_url.path, body.links[].href_url.query_params, body.links[].href_url.query_params_decoded, type.inbound. Sensors: regex.iextract, strings.parse_url.
Indicators matched (4)
| Field | Match | Value |
|---|---|---|
body.links[].href_url.domain.domain | equals | mailtrack.ksd.or.kr |
body.links[].href_url.path | equals | /TMS/tracking |
keys(body.links[].href_url.query_params_decoded) | contains | url |
regex.iextract | regex | url=([^&]+)(?:\&|\/|$) |