Open redirect: Linkedin

name: "Open redirect: Linkedin"
description: "Detects emails containing links using Linkedin '/slink?code=xxxxx' open redirect where the email has not come from Linkedin.com"
references:
  - "https://krebsonsecurity.com/2022/02/how-phishers-are-slinking-their-links-into-linkedin/"
type: "rule"
authors:
  - twitter: "xNymia"
severity: "medium"
source: |
  type.inbound
  and (
    (
      sender.email.domain.root_domain != "linkedin.com"
      and (
        (
          any(body.links,
              .href_url.domain.root_domain == 'linkedin.com'
              and .href_url.path == '/slink'
          )
          and any(body.links, strings.ilike(.href_url.query_params, 'code=*'))
        )
        or any(body.links,
               .href_url.domain.root_domain == 'linkedin.com'
               and strings.icontains(.href_url.query_params, 'redirect_uri')
        )
      )
    )
    or any(attachments,
           .file_type == "pdf"
           and any(file.explode(.),
                   (
                     any(.scan.url.urls,
                         .domain.root_domain == 'linkedin.com'
                         and .path == '/slink'
                     )
                     and any(.scan.url.urls,
                             strings.ilike(.query_params, 'code=*')
                     )
                   )
                   or any(.scan.url.urls,
                          .domain.root_domain == 'linkedin.com'
                          and strings.icontains(.query_params, 'redirect_uri')
                   )
           )
    )
  )
tags:
  - "Attack surface reduction"
attack_types:
  - "Credential Phishing"
  - "Malware/Ransomware"
tactics_and_techniques:
  - "Open redirect"
detection_methods:
  - "Sender analysis"
  - "URL analysis"
id: "5ad2ffae-fca7-58ff-90bd-8efbd98c0a72"