detection.wiki

Detection rules › Sublime MQL

Open redirect: Xfinity CMP Redirection to Google AMP

Severity
medium
Type
rule
Source
github.com/sublime-security/sublime-rules

Detects when non-Xfinity senders abuse Xfinity's CMP redirection service to reach Google AMP pages. The rule specifically looks for targetURL parameters containing Google AMP paths in links from untrusted or previously malicious senders.

Threat classification

Sublime's own taxonomy (not MITRE ATT&CK).

CategoryValues
Attack typesCredential Phishing
Tactics and techniquesOpen redirect, Evasion

Event coverage

Message attribute
body
body.links (collection)
headers.auth_summary
sender.email
type

Rule body MQL

type.inbound
and any(body.links,
        .href_url.domain.domain == "cmp.cws.xfinity.com"
        and strings.icontains(.href_url.query_params, "&targetURL=")
        and regex.icontains(.href_url.query_params,
                            '&targetUrl=(?:https?)?(?:(?:%3a|\:)?(?:\/|%2f){2})?google\.[^\&]*\/+amp\/+s\/+'
        )
)
and not sender.email.domain.root_domain in ("xfinity.com", "comcast.net")

// negate highly trusted sender domains unless they fail DMARC authentication
and (
  (
    sender.email.domain.root_domain in $high_trust_sender_root_domains
    and not headers.auth_summary.dmarc.pass
  )
  or sender.email.domain.root_domain not in $high_trust_sender_root_domains
)

Detection logic

Scope: inbound message.

Detects when non-Xfinity senders abuse Xfinity's CMP redirection service to reach Google AMP pages. The rule specifically looks for targetURL parameters containing Google AMP paths in links from untrusted or previously malicious senders.

  1. inbound message
  2. any of body.links where all hold:
    • .href_url.domain.domain is 'cmp.cws.xfinity.com'
    • .href_url.query_params contains '&targetURL='
    • .href_url.query_params matches '&targetUrl=(?:https?)?(?:(?:%3a|\\:)?(?:\\/|%2f){2})?google\\.[^\\&]*\\/+amp\\/+s\\/+'
  3. not:
    • sender.email.domain.root_domain in ('xfinity.com', 'comcast.net')
  4. any of:
    • all of:
      • sender.email.domain.root_domain in $high_trust_sender_root_domains
      • not:
        • headers.auth_summary.dmarc.pass
    • sender.email.domain.root_domain not in $high_trust_sender_root_domains

Inspects: body.links, body.links[].href_url.domain.domain, body.links[].href_url.query_params, headers.auth_summary.dmarc.pass, sender.email.domain.root_domain, type.inbound. Sensors: regex.icontains, strings.icontains. Reference lists: $high_trust_sender_root_domains.

Indicators matched (5)

FieldMatchValue
body.links[].href_url.domain.domainequalscmp.cws.xfinity.com
strings.icontainssubstring&targetURL=
regex.icontainsregex&targetUrl=(?:https?)?(?:(?:%3a|\:)?(?:\/|%2f){2})?google\.[^\&]*\/+amp\/+s\/+
sender.email.domain.root_domainmemberxfinity.com
sender.email.domain.root_domainmembercomcast.net