From 23ae3bbb0560e92b01fdc782ef4391c52acc4300 Mon Sep 17 00:00:00 2001 From: Sublime Rule Testing Bot Date: Thu, 23 Jan 2025 03:32:09 +0000 Subject: [PATCH] Sync from PR#2328 Create open_redirect_qrxtech.yml by @zoomequipd https://github.com/sublime-security/sublime-rules/pull/2328 Source SHA 3ea7655cefc4f5eb794ae39c2ef6724fd4dc9b81 Triggered by @zoomequipd --- detection-rules/open_redirect_qrxtech.yml | 37 +++++++++++++++++++++++ 1 file changed, 37 insertions(+) create mode 100644 detection-rules/open_redirect_qrxtech.yml diff --git a/detection-rules/open_redirect_qrxtech.yml b/detection-rules/open_redirect_qrxtech.yml new file mode 100644 index 00000000000..213b6a8f7f4 --- /dev/null +++ b/detection-rules/open_redirect_qrxtech.yml @@ -0,0 +1,37 @@ +name: "Open Redirect: qrxtech.com" +description: | + Message contains use of the qrxtech.com open redirect. This has been exploited in the wild. +type: "rule" +severity: "medium" +source: | + type.inbound + and any(body.links, + .href_url.domain.root_domain == "qrxtech.com" + and strings.iends_with(.href_url.path, 'XMLServer.aspx') + and strings.icontains(.href_url.query_params, 'HREF=') + and strings.icontains(.href_url.query_params, 'FUNC=') + and not strings.icontains(.href_url.query_params, + 'HREF=[^\&]+qrxtech.com' + ) + ) + // remove uses that originate from convertcart.com + and not any(headers.domains, .root_domain == "qrxtech.com") + // negate highly trusted sender domains unless they fail DMARC authentication + and ( + ( + sender.email.domain.root_domain in $high_trust_sender_root_domains + and not headers.auth_summary.dmarc.pass + ) + or sender.email.domain.root_domain not in $high_trust_sender_root_domains + ) +attack_types: + - "Credential Phishing" + - "Malware/Ransomware" +tactics_and_techniques: + - "Open redirect" +detection_methods: + - "Sender analysis" + - "URL analysis" +id: "b790552a-b115-50f8-b1ed-9fb3731824df" +testing_pr: 2328 +testing_sha: 3ea7655cefc4f5eb794ae39c2ef6724fd4dc9b81