From a53b1f8c5af4bdae1e7d24f0b9767c9d1ed8d3fc Mon Sep 17 00:00:00 2001 From: Brandon Murphy <4827852+zoomequipd@users.noreply.github.com> Date: Fri, 27 Dec 2024 16:11:16 -0600 Subject: [PATCH 1/4] Create open_redirect_nowlifestyle.yml --- .../open_redirect_nowlifestyle.yml | 38 +++++++++++++++++++ 1 file changed, 38 insertions(+) create mode 100644 detection-rules/open_redirect_nowlifestyle.yml diff --git a/detection-rules/open_redirect_nowlifestyle.yml b/detection-rules/open_redirect_nowlifestyle.yml new file mode 100644 index 00000000000..96e1b3d87cf --- /dev/null +++ b/detection-rules/open_redirect_nowlifestyle.yml @@ -0,0 +1,38 @@ +ame: "Open Redirect: nowlifestyle.com" +description: | + Message contains use of the nowlifestyle.com open redirect. This has been exploited in the wild. +type: "rule" +severity: "medium" +source: | + type.inbound + and any(body.links, + .href_url.domain.root_domain == "nowlifestyle.com" + and strings.icontains(.href_url.path, "/redir.php") + and regex.icontains(.href_url.query_params, 'url=(?:https?|(?:\/|%2f)(?:\/|%2f))') + and not regex.icontains(.href_url.query_params, 'url=[^\&]*nowlifestyle\.com') + + ) + and not sender.email.domain.root_domain == "nowlifestyle.com" + and ( + not profile.by_sender().solicited + or ( + profile.by_sender().any_messages_malicious_or_spam + and not profile.by_sender().any_false_positives + ) + ) + + // negate highly trusted sender domains unless they fail DMARC authentication + and ( + ( + sender.email.domain.root_domain in $high_trust_sender_root_domains + and not headers.auth_summary.dmarc.pass + ) + or sender.email.domain.root_domain not in $high_trust_sender_root_domains + ) +attack_types: + - "Credential Phishing" +tactics_and_techniques: + - "Open redirect" +detection_methods: + - "Sender analysis" + - "URL analysis" From 230d0f369c9b09a0f0c846cd639bbcb0033aeeb1 Mon Sep 17 00:00:00 2001 From: Brandon Murphy <4827852+zoomequipd@users.noreply.github.com> Date: Fri, 27 Dec 2024 16:14:22 -0600 Subject: [PATCH 2/4] Update open_redirect_nowlifestyle.yml --- .../open_redirect_nowlifestyle.yml | 53 ++++++++++--------- 1 file changed, 28 insertions(+), 25 deletions(-) diff --git a/detection-rules/open_redirect_nowlifestyle.yml b/detection-rules/open_redirect_nowlifestyle.yml index 96e1b3d87cf..3d89273b4c4 100644 --- a/detection-rules/open_redirect_nowlifestyle.yml +++ b/detection-rules/open_redirect_nowlifestyle.yml @@ -4,31 +4,34 @@ description: | type: "rule" severity: "medium" source: | - type.inbound - and any(body.links, - .href_url.domain.root_domain == "nowlifestyle.com" - and strings.icontains(.href_url.path, "/redir.php") - and regex.icontains(.href_url.query_params, 'url=(?:https?|(?:\/|%2f)(?:\/|%2f))') - and not regex.icontains(.href_url.query_params, 'url=[^\&]*nowlifestyle\.com') - - ) - and not sender.email.domain.root_domain == "nowlifestyle.com" - and ( - not profile.by_sender().solicited - or ( - profile.by_sender().any_messages_malicious_or_spam - and not profile.by_sender().any_false_positives - ) - ) - - // negate highly trusted sender domains unless they fail DMARC authentication - and ( - ( - sender.email.domain.root_domain in $high_trust_sender_root_domains - and not headers.auth_summary.dmarc.pass - ) - or sender.email.domain.root_domain not in $high_trust_sender_root_domains - ) + type.inbound + and any(body.links, + .href_url.domain.root_domain == "nowlifestyle.com" + and strings.icontains(.href_url.path, "/redir.php") + and regex.icontains(.href_url.query_params, + 'url=(?:https?|(?:\/|%2f)(?:\/|%2f))' + ) + and not regex.icontains(.href_url.query_params, + 'url=[^\&]*nowlifestyle\.com' + ) + ) + and not sender.email.domain.root_domain == "nowlifestyle.com" + and ( + not profile.by_sender().solicited + or ( + profile.by_sender().any_messages_malicious_or_spam + and not profile.by_sender().any_false_positives + ) + ) + + // negate highly trusted sender domains unless they fail DMARC authentication + and ( + ( + sender.email.domain.root_domain in $high_trust_sender_root_domains + and not headers.auth_summary.dmarc.pass + ) + or sender.email.domain.root_domain not in $high_trust_sender_root_domains + ) attack_types: - "Credential Phishing" tactics_and_techniques: From 0f7fb6539d390526e0bc9c621629a2d926913972 Mon Sep 17 00:00:00 2001 From: ID Generator Date: Fri, 27 Dec 2024 22:14:47 +0000 Subject: [PATCH 3/4] Auto add rule ID --- detection-rules/open_redirect_nowlifestyle.yml | 1 + 1 file changed, 1 insertion(+) diff --git a/detection-rules/open_redirect_nowlifestyle.yml b/detection-rules/open_redirect_nowlifestyle.yml index 3d89273b4c4..217068b143a 100644 --- a/detection-rules/open_redirect_nowlifestyle.yml +++ b/detection-rules/open_redirect_nowlifestyle.yml @@ -39,3 +39,4 @@ tactics_and_techniques: detection_methods: - "Sender analysis" - "URL analysis" +id: "a2bea3a3-5673-5c56-9042-36bf67ece793" From e0363b05d61d3aecf8ad4a17ae13608746de7365 Mon Sep 17 00:00:00 2001 From: Cameron Dunn Date: Tue, 31 Dec 2024 14:00:08 -0800 Subject: [PATCH 4/4] Update detection-rules/open_redirect_nowlifestyle.yml --- detection-rules/open_redirect_nowlifestyle.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/detection-rules/open_redirect_nowlifestyle.yml b/detection-rules/open_redirect_nowlifestyle.yml index 217068b143a..ab9ebdae07e 100644 --- a/detection-rules/open_redirect_nowlifestyle.yml +++ b/detection-rules/open_redirect_nowlifestyle.yml @@ -1,4 +1,4 @@ -ame: "Open Redirect: nowlifestyle.com" +name: "Open Redirect: nowlifestyle.com" description: | Message contains use of the nowlifestyle.com open redirect. This has been exploited in the wild. type: "rule"