Sync from PR#2254

Create open_redirect_xfinity.yml by @zoomequipd
#2254
Source SHA a2da308
Triggered by @zoomequipd

detection-rules/open_redirect_xfinity.yml

@@ -1,42 +1,43 @@
-name: "Open Redirect: Xfinity CMP Redirection to Google AMP"
-description: "Detects when non-Xfinity senders abuse Xfinity's CMP redirection service to reach Google AMP pages. The rule specifically looks for targetURL parameters containing Google AMP paths in links from untrusted or previously malicious senders."
+name: "Open Redirect: xfinity.com"
+description: |
+  Message contains use of the xfinity.com open redirect. This has been exploited in the wild.
 type: "rule"
 severity: "medium"
 source: |
   type.inbound
   and any(body.links,
-          .href_url.domain.domain == "cmp.cws.xfinity.com"
-          and strings.icontains(.href_url.query_params, "&targetURL=")
-          and regex.icontains(.href_url.query_params,
-                              '&targetUrl=(?:https?)?(?:(?:%3a|\:)?(?:\/|%2f){2})?google\.[^\&]*\/+amp\/+s\/+'
+          .href_url.domain.root_domain == "xfinity.com"
+          and strings.icontains(.href_url.path, "/learn/cima/login")
+          and strings.icontains(.href_url.query_params, "referer=")
+          and not regex.icontains(.href_url.query_params,
+                                  'referer=(?:https?)?(?:(?:%3a|\:)?(?:\/|%2f){2})?xfinity\.com+'
           )
   )
   and not sender.email.domain.root_domain in ("xfinity.com", "comcast.net")
   and (
-    not profile.by_sender().solicited
-    or (
+  not profile.by_sender().solicited
+  or (
       profile.by_sender().any_messages_malicious_or_spam
       and not profile.by_sender().any_false_positives
-    )
+  )
   )
 
   // negate highly trusted sender domains unless they fail DMARC authentication
   and (
-    (
+  (
       sender.email.domain.root_domain in $high_trust_sender_root_domains
       and not headers.auth_summary.dmarc.pass
-    )
-    or sender.email.domain.root_domain not in $high_trust_sender_root_domains
+  )
+  or sender.email.domain.root_domain not in $high_trust_sender_root_domains
   )
 attack_types:
   - "Credential Phishing"
+  - "Malware/Ransomware"
 tactics_and_techniques:
   - "Open redirect"
-  - "Evasion"
 detection_methods:
-  - "Header analysis"
-  - "URL analysis"
   - "Sender analysis"
+  - "URL analysis"
 id: "7b9012fa-0f14-57d5-b729-cb3b84565c47"
-testing_pr: 2249
-testing_sha: 69a81a651ce93b0ea0e62747bf96a2a149db4244
+testing_pr: 2254
+testing_sha: a2da308a2f6a78e46caf2095c087601a4be2e250