Detection rules › Sublime MQL
Open redirect: obunsha.co.jp
Detects messages containing Obunsha's passnavi redirect service that can be exploited to redirect users to malicious sites. This has been used in phishing campaigns.
Threat classification
Sublime's own taxonomy (not MITRE ATT&CK).
| Category | Values |
|---|---|
| Attack types | Credential Phishing, Malware/Ransomware |
| Tactics and techniques | Open redirect |
Event coverage
| Message attribute |
|---|
| body |
| body.links (collection) |
| headers.auth_summary |
| sender.email |
| type |
Rule body MQL
type.inbound
and any(body.links,
// Look for Obunsha passnavi URLs
.href_url.domain.domain == "passnavi.obunsha.co.jp"
and strings.icontains(.href_url.path, '/ct.html')
and strings.icontains(.href_url.query_params, 'uri=')
// Make sure it's not redirecting back to obunsha domains
and not regex.icontains(.href_url.query_params,
'uri=(?:https?(?:%3a|:))?(?:%2f|\/){2}[^&]*obunsha\.co\.jp(?:\&|\/|$|%2f)'
)
)
// Exclude legitimate Obunsha domains as senders
and not sender.email.domain.root_domain == "obunsha.co.jp"
// negate highly trusted sender domains unless they fail DMARC authentication
and (
(
sender.email.domain.root_domain in $high_trust_sender_root_domains
and not headers.auth_summary.dmarc.pass
)
or sender.email.domain.root_domain not in $high_trust_sender_root_domains
)
Detection logic
Scope: inbound message.
Detects messages containing Obunsha's passnavi redirect service that can be exploited to redirect users to malicious sites. This has been used in phishing campaigns.
- inbound message
any of
body.linkswhere all hold:- .href_url.domain.domain is 'passnavi.obunsha.co.jp'
- .href_url.path contains '/ct.html'
- .href_url.query_params contains 'uri='
not:
- .href_url.query_params matches 'uri=(?:https?(?:%3a|:))?(?:%2f|\\/){2}[^&]*obunsha\\.co\\.jp(?:\\&|\\/|$|%2f)'
not:
- sender.email.domain.root_domain is 'obunsha.co.jp'
any of:
all of:
- sender.email.domain.root_domain in $high_trust_sender_root_domains
not:
- headers.auth_summary.dmarc.pass
- sender.email.domain.root_domain not in $high_trust_sender_root_domains
Inspects: body.links, body.links[].href_url.domain.domain, body.links[].href_url.path, body.links[].href_url.query_params, headers.auth_summary.dmarc.pass, sender.email.domain.root_domain, type.inbound. Sensors: regex.icontains, strings.icontains. Reference lists: $high_trust_sender_root_domains.
Indicators matched (5)
| Field | Match | Value |
|---|---|---|
body.links[].href_url.domain.domain | equals | passnavi.obunsha.co.jp |
strings.icontains | substring | /ct.html |
strings.icontains | substring | uri= |
regex.icontains | regex | uri=(?:https?(?:%3a|:))?(?:%2f|\/){2}[^&]*obunsha\.co\.jp(?:\&|\/|$|%2f) |
sender.email.domain.root_domain | equals | obunsha.co.jp |