Detection rules › Sublime MQL
Open redirect: Shibboleth SSO Logout Return Parameter
Detects links that contain a Shibboleth SSO logout endpoint with a return parameter, which could be used for open redirect attacks. The rule checks for both direct path inclusion and URL-encoded versions in query parameters. Only triggers on senders with non-common prevalence.
Threat classification
Sublime's own taxonomy (not MITRE ATT&CK).
| Category | Values |
|---|---|
| Attack types | Credential Phishing |
| Tactics and techniques | Open redirect, Evasion |
Event coverage
| Message attribute |
|---|
| body |
| body.links (collection) |
| type |
Rule body MQL
type.inbound
and any(body.links,
// uses shibboleth.sso directly within the path
(
strings.icontains(.href_url.path, '/Shibboleth.sso/Logout')
and strings.icontains(.href_url.path, 'return=')
)
// or url encoded within the query_params
or (
strings.icontains(.href_url.query_params, 'Shibboleth.sso%2fLogout')
and strings.icontains(.href_url.query_params, "return%3d")
)
)
and profile.by_sender_email().prevalence != "common"
Detection logic
Scope: inbound message.
Detects links that contain a Shibboleth SSO logout endpoint with a return parameter, which could be used for open redirect attacks. The rule checks for both direct path inclusion and URL-encoded versions in query parameters. Only triggers on senders with non-common prevalence.
- inbound message
any of
body.linkswhere any holds:all of:
- .href_url.path contains '/Shibboleth.sso/Logout'
- .href_url.path contains 'return='
all of:
- .href_url.query_params contains 'Shibboleth.sso%2fLogout'
- .href_url.query_params contains 'return%3d'
- profile.by_sender_email().prevalence is not 'common'
Inspects: body.links, body.links[].href_url.path, body.links[].href_url.query_params, type.inbound. Sensors: profile.by_sender_email, strings.icontains.
Indicators matched (4)
| Field | Match | Value |
|---|---|---|
strings.icontains | substring | /Shibboleth.sso/Logout |
strings.icontains | substring | return= |
strings.icontains | substring | Shibboleth.sso%2fLogout |
strings.icontains | substring | return%3d |