From 139ea8fcf2e7437f573b519cc04ee8f3b34f125d Mon Sep 17 00:00:00 2001 From: Sam Scholten Date: Tue, 5 Dec 2023 12:43:49 -0500 Subject: [PATCH] Update open_redirect_youtube.yml (#1086) --- detection-rules/open_redirect_youtube.yml | 24 ++++++++++++++++++++++- 1 file changed, 23 insertions(+), 1 deletion(-) diff --git a/detection-rules/open_redirect_youtube.yml b/detection-rules/open_redirect_youtube.yml index 908c6eeb252..2850bdea022 100644 --- a/detection-rules/open_redirect_youtube.yml +++ b/detection-rules/open_redirect_youtube.yml @@ -11,7 +11,29 @@ source: | .href_url.domain.root_domain == "youtube.com" and strings.icontains(.href_url.url, "attribution_link?") ) - and sender.email.domain.root_domain != "youtube.com" + and ( + any(distinct(headers.hops, .authentication_results.dmarc is not null), + .authentication_results.dmarc_details.from.domain != "youtube.com" + ) + ) + + // negate highly trusted sender domains unless they fail DMARC authentication + and ( + ( + sender.email.domain.root_domain in $high_trust_sender_root_domains + and ( + any(distinct(headers.hops, .authentication_results.dmarc is not null), + strings.ilike(.authentication_results.dmarc, "*fail") + ) + ) + ) + or sender.email.domain.root_domain not in $high_trust_sender_root_domains + ) + and ( + not profile.by_sender().solicited + or profile.by_sender().any_messages_malicious_or_spam + ) + attack_types: - "Credential Phishing" - "Malware/Ransomware"