Detection rules › Sublime MQL

Open redirect: obunsha.co.jp

Severity
medium
Type
rule
Source
github.com/sublime-security/sublime-rules

Detects messages containing Obunsha's passnavi redirect service that can be exploited to redirect users to malicious sites. This has been used in phishing campaigns.

Threat classification

Sublime's own taxonomy (not MITRE ATT&CK).

CategoryValues
Attack typesCredential Phishing, Malware/Ransomware
Tactics and techniquesOpen redirect

Event coverage

Rule body MQL

type.inbound
and any(body.links,
        // Look for Obunsha passnavi URLs
        .href_url.domain.domain == "passnavi.obunsha.co.jp"
        and strings.icontains(.href_url.path, '/ct.html')
        and strings.icontains(.href_url.query_params, 'uri=')
        // Make sure it's not redirecting back to obunsha domains
        and not regex.icontains(.href_url.query_params,
                                'uri=(?:https?(?:%3a|:))?(?:%2f|\/){2}[^&]*obunsha\.co\.jp(?:\&|\/|$|%2f)'
        )
)
// Exclude legitimate Obunsha domains as senders
and not sender.email.domain.root_domain == "obunsha.co.jp"

// negate highly trusted sender domains unless they fail DMARC authentication
and (
  (
    sender.email.domain.root_domain in $high_trust_sender_root_domains
    and not headers.auth_summary.dmarc.pass
  )
  or sender.email.domain.root_domain not in $high_trust_sender_root_domains
)

Detection logic

Scope: inbound message.

Detects messages containing Obunsha's passnavi redirect service that can be exploited to redirect users to malicious sites. This has been used in phishing campaigns.

  1. inbound message
  2. any of body.links where all hold:
    • .href_url.domain.domain is 'passnavi.obunsha.co.jp'
    • .href_url.path contains '/ct.html'
    • .href_url.query_params contains 'uri='
    • not:
      • .href_url.query_params matches 'uri=(?:https?(?:%3a|:))?(?:%2f|\\/){2}[^&]*obunsha\\.co\\.jp(?:\\&|\\/|$|%2f)'
  3. not:
    • sender.email.domain.root_domain is 'obunsha.co.jp'
  4. any of:
    • all of:
      • sender.email.domain.root_domain in $high_trust_sender_root_domains
      • not:
        • headers.auth_summary.dmarc.pass
    • sender.email.domain.root_domain not in $high_trust_sender_root_domains

Inspects: body.links, body.links[].href_url.domain.domain, body.links[].href_url.path, body.links[].href_url.query_params, headers.auth_summary.dmarc.pass, sender.email.domain.root_domain, type.inbound. Sensors: regex.icontains, strings.icontains. Reference lists: $high_trust_sender_root_domains.

Indicators matched (5)

FieldMatchValue
body.links[].href_url.domain.domainequalspassnavi.obunsha.co.jp
strings.icontainssubstring/ct.html
strings.icontainssubstringuri=
regex.icontainsregexuri=(?:https?(?:%3a|:))?(?:%2f|\/){2}[^&]*obunsha\.co\.jp(?:\&|\/|$|%2f)
sender.email.domain.root_domainequalsobunsha.co.jp