Detection rules › Sublime MQL

Open redirect: Ticketmaster

Severity
low
Type
rule
Source
github.com/sublime-security/sublime-rules

Message contains use of the Ticketmaster open redirect, but the sender is not Ticketmaster. This has been exploited in the wild.

Threat classification

Sublime's own taxonomy (not MITRE ATT&CK).

CategoryValues
Attack typesCredential Phishing, Malware/Ransomware
Tactics and techniquesOpen redirect

Event coverage

Rule body MQL

type.inbound
and any(body.links,
        .href_url.domain.domain == 'links.engage.ticketmaster.com'
        and .href_url.path =~ '/ctt'
)
and sender.email.domain.root_domain != 'ticketmaster.com'
and headers.return_path.domain.root_domain != "ticketmaster.com"

// negate highly trusted sender domains unless they fail DMARC authentication
and (
  (
    sender.email.domain.root_domain in $high_trust_sender_root_domains
    and not headers.auth_summary.dmarc.pass
  )
  or sender.email.domain.root_domain not in $high_trust_sender_root_domains
)

Detection logic

Scope: inbound message.

Message contains use of the Ticketmaster open redirect, but the sender is not Ticketmaster. This has been exploited in the wild.

  1. inbound message
  2. any of body.links where all hold:
    • .href_url.domain.domain is 'links.engage.ticketmaster.com'
    • .href_url.path is '/ctt'
  3. sender.email.domain.root_domain is not 'ticketmaster.com'
  4. headers.return_path.domain.root_domain is not 'ticketmaster.com'
  5. any of:
    • all of:
      • sender.email.domain.root_domain in $high_trust_sender_root_domains
      • not:
        • headers.auth_summary.dmarc.pass
    • sender.email.domain.root_domain not in $high_trust_sender_root_domains

Inspects: body.links, body.links[].href_url.domain.domain, body.links[].href_url.path, headers.auth_summary.dmarc.pass, headers.return_path.domain.root_domain, sender.email.domain.root_domain, type.inbound. Reference lists: $high_trust_sender_root_domains.

Indicators matched (2)

FieldMatchValue
body.links[].href_url.domain.domainequalslinks.engage.ticketmaster.com
body.links[].href_url.pathequals/ctt