sublimehighRule

Service abuse: Google Tag Manager debug cookie clearing with open redirect potential

Detects messages containing links to Google Tag Manager's debug cookie clearing endpoint with suspicious URL parameters that may be exploited for open redirects, or links that have been rewritten through Google Tag Manager encoding methods.

MITRE ATT&CK

T1566 T1566.001 T1566.002 T1598

Detection Query

type.inbound
and any(body.links,
        (
          .href_url.domain.root_domain == "googletagmanager.com"
          and .href_url.path == "/debug/clearcookies"
          and any(.href_url.query_params_decoded["url"],
                  strings.parse_url(.).domain.valid
          )
        )
        or 'google_tag_manager' in .href_url.rewrite.encoders
)

Data Sources

Email MessagesEmail HeadersEmail Attachments

Platforms

Raw Content

name: "Service abuse: Google Tag Manager debug cookie clearing with open redirect potential"
description: "Detects messages containing links to Google Tag Manager's debug cookie clearing endpoint with suspicious URL parameters that may be exploited for open redirects, or links that have been rewritten through Google Tag Manager encoding methods."
type: "rule"
severity: "high"
source: |
  type.inbound
  and any(body.links,
          (
            .href_url.domain.root_domain == "googletagmanager.com"
            and .href_url.path == "/debug/clearcookies"
            and any(.href_url.query_params_decoded["url"],
                    strings.parse_url(.).domain.valid
            )
          )
          or 'google_tag_manager' in .href_url.rewrite.encoders
  )
attack_types:
  - "Credential Phishing"
tactics_and_techniques:
  - "Open redirect"
  - "Service abuse"
detection_methods:
  - "URL analysis"
  - "Content analysis"
id: "a69a939a-7c2d-537d-b476-ac99daf6d3d9"