Detection rules › Sublime MQL

Open redirect: Samsung

Severity
medium
Type
rule
Source
github.com/sublime-security/sublime-rules

Message contains use of the Samsung open redirect, but the sender is not Samsung.

Threat classification

Sublime's own taxonomy (not MITRE ATT&CK).

CategoryValues
Attack typesCredential Phishing, Malware/Ransomware
Tactics and techniquesOpen redirect

Event coverage

Rule body MQL

type.inbound
and any(body.links,
        (
          .href_url.domain.domain == 't.info.samsungusa.com'
          and .href_url.path =~ '/r/'
        )
        or (
          .href_url.domain.root_domain == "samsung.com"
          and strings.iends_with(.href_url.domain.subdomain, '.email')
          and strings.icontains(.href_url.path, '/r/')
          and strings.icontains(.href_url.query_params, 'id=')
          and strings.icontains(.href_url.query_params, 'p1=')
          // with redirects to google/doubleclick
          and regex.icontains(.href_url.query_params,
                              'p1=[^\&]*(?:google\.|doubleclick\.net)'
          )
        )
)
and sender.email.domain.root_domain not in ('samsungusa.com', 'samsung.com')

Detection logic

Scope: inbound message.

Message contains use of the Samsung open redirect, but the sender is not Samsung.

  1. inbound message
  2. any of body.links where any holds:
    • all of:
      • .href_url.domain.domain is 't.info.samsungusa.com'
      • .href_url.path is '/r/'
    • all of:
      • .href_url.domain.root_domain is 'samsung.com'
      • .href_url.domain.subdomain ends with '.email'
      • .href_url.path contains '/r/'
      • .href_url.query_params contains 'id='
      • .href_url.query_params contains 'p1='
      • .href_url.query_params matches 'p1=[^\\&]*(?:google\\.|doubleclick\\.net)'
  3. sender.email.domain.root_domain not in ('samsungusa.com', 'samsung.com')

Inspects: body.links, body.links[].href_url.domain.domain, body.links[].href_url.domain.root_domain, body.links[].href_url.domain.subdomain, body.links[].href_url.path, body.links[].href_url.query_params, sender.email.domain.root_domain, type.inbound. Sensors: regex.icontains, strings.icontains, strings.iends_with.

Indicators matched (10)

FieldMatchValue
body.links[].href_url.domain.domainequalst.info.samsungusa.com
body.links[].href_url.pathequals/r/
body.links[].href_url.domain.root_domainequalssamsung.com
strings.iends_withsuffix.email
strings.icontainssubstring/r/
strings.icontainssubstringid=
strings.icontainssubstringp1=
regex.icontainsregexp1=[^\&]*(?:google\.|doubleclick\.net)
sender.email.domain.root_domainmembersamsungusa.com
sender.email.domain.root_domainmembersamsung.com