detection.wiki

Detection rules › Sublime MQL

Open redirect: VK

Severity
medium
Type
rule
Source
github.com/sublime-security/sublime-rules

Message contains use of the VK open redirect, but the sender is not VK. This has been exploited in the wild.

Threat classification

Sublime's own taxonomy (not MITRE ATT&CK).

CategoryValues
Attack typesCredential Phishing, Malware/Ransomware
Tactics and techniquesOpen redirect

Event coverage

Message attribute
body
body.links (collection)
sender.email
type

Rule body MQL

type.inbound
and any(body.links,
        .href_url.domain.root_domain == 'vk.com'
        and strings.iends_with(.href_url.path, '/away.php')
)
and sender.email.domain.root_domain != 'vk.com'

Detection logic

Scope: inbound message.

Message contains use of the VK open redirect, but the sender is not VK. This has been exploited in the wild.

  1. inbound message
  2. any of body.links where all hold:
    • .href_url.domain.root_domain is 'vk.com'
    • .href_url.path ends with '/away.php'
  3. sender.email.domain.root_domain is not 'vk.com'

Inspects: body.links, body.links[].href_url.domain.root_domain, body.links[].href_url.path, sender.email.domain.root_domain, type.inbound. Sensors: strings.iends_with.

Indicators matched (2)

FieldMatchValue
body.links[].href_url.domain.root_domainequalsvk.com
strings.iends_withsuffix/away.php