Sublime Security high experimental mql

Service abuse: Google Tag Manager debug cookie clearing with open redirect potential

Detects messages containing links to Google Tag Manager's debug cookie clearing endpoint with suspicious URL parameters that may be exploited for open redirects, or links that have been rewritten through Google Tag Manager encoding methods.

View Source

Detection Logic

type.inbound
and any(body.links,
        (
          .href_url.domain.root_domain == "googletagmanager.com"
          and .href_url.path == "/debug/clearcookies"
          and any(.href_url.query_params_decoded["url"],
                  strings.parse_url(.).domain.valid
          )
        )
        or 'google_tag_manager' in .href_url.rewrite.encoders
)

Field Validations

Loading…

Comments (0)

Loading comments...