From 0722e4f7c9734b203a6eddf4965f3aa6d6a7e397 Mon Sep 17 00:00:00 2001 From: Sam Scholten Date: Thu, 7 Sep 2023 22:47:09 -0400 Subject: [PATCH] New Rule: Open redirect: U.S. Antarctic Program Data Center (USAP-DC) (#779) Co-authored-by: ID Generator --- detection-rules/open_redirect_usapdc.yml | 20 ++++++++++++++++++++ 1 file changed, 20 insertions(+) create mode 100644 detection-rules/open_redirect_usapdc.yml diff --git a/detection-rules/open_redirect_usapdc.yml b/detection-rules/open_redirect_usapdc.yml new file mode 100644 index 00000000000..92b69306be2 --- /dev/null +++ b/detection-rules/open_redirect_usapdc.yml @@ -0,0 +1,20 @@ +name: "Open redirect: U.S. Antarctic Program Data Center (USAP-DC)" +description: | + Message contains use of the U.S. Antarctic Program Data Center (USAP-DC) open redirect. +type: "rule" +severity: "medium" +source: | + type.inbound + and any(body.links, + .href_url.domain.root_domain == "usap-dc.org" + and .href_url.path =~ "/tracker" + and strings.starts_with(.href_url.query_params, "type=dataset&url=http") + ) +attack_types: + - "Credential Phishing" + - "Malware/Ransomware" +tactics_and_techniques: + - "Open redirect" +detection_methods: + - "URL analysis" +id: "c499d041-1e95-52a5-bc7e-857376e1a873"