Sublime Security medium experimental mql

Open redirect: BMW USA

Message contains use of BMW USA's open redirect but the sender is not BMW.

View Source

Detection Logic

type.inbound
and sender.email.domain.root_domain not in~ ('bmw.com', 'bmwusa.com')
and any(body.links,
        .href_url.domain.domain == 't.msg.bmwusa.com'
        and .href_url.path =~ '/r/'
)

Field Validations

Loading…

Comments (0)

Loading comments...