sublimemediumRule

Open redirect: Xfinity CMP Redirection to Google AMP

Detects when non-Xfinity senders abuse Xfinity's CMP redirection service to reach Google AMP pages. The rule specifically looks for targetURL parameters containing Google AMP paths in links from untrusted or previously malicious senders.

MITRE ATT&CK

T1566 T1566.001 T1566.002 T1598 T1036 T1027

defense-evasion

Detection Query

type.inbound
and any(body.links,
        .href_url.domain.domain == "cmp.cws.xfinity.com"
        and strings.icontains(.href_url.query_params, "&targetURL=")
        and regex.icontains(.href_url.query_params,
                            '&targetUrl=(?:https?)?(?:(?:%3a|\:)?(?:\/|%2f){2})?google\.[^\&]*\/+amp\/+s\/+'
        )
)
and not sender.email.domain.root_domain in ("xfinity.com", "comcast.net")

// negate highly trusted sender domains unless they fail DMARC authentication
and (
  (
    sender.email.domain.root_domain in $high_trust_sender_root_domains
    and not headers.auth_summary.dmarc.pass
  )
  or sender.email.domain.root_domain not in $high_trust_sender_root_domains
)

Data Sources

Email MessagesEmail HeadersEmail Attachments

Platforms

Raw Content

name: "Open redirect: Xfinity CMP Redirection to Google AMP"
description: "Detects when non-Xfinity senders abuse Xfinity's CMP redirection service to reach Google AMP pages. The rule specifically looks for targetURL parameters containing Google AMP paths in links from untrusted or previously malicious senders."
type: "rule"
severity: "medium"
source: |
  type.inbound
  and any(body.links,
          .href_url.domain.domain == "cmp.cws.xfinity.com"
          and strings.icontains(.href_url.query_params, "&targetURL=")
          and regex.icontains(.href_url.query_params,
                              '&targetUrl=(?:https?)?(?:(?:%3a|\:)?(?:\/|%2f){2})?google\.[^\&]*\/+amp\/+s\/+'
          )
  )
  and not sender.email.domain.root_domain in ("xfinity.com", "comcast.net")
  
  // negate highly trusted sender domains unless they fail DMARC authentication
  and (
    (
      sender.email.domain.root_domain in $high_trust_sender_root_domains
      and not headers.auth_summary.dmarc.pass
    )
    or sender.email.domain.root_domain not in $high_trust_sender_root_domains
  )
attack_types:
  - "Credential Phishing"
tactics_and_techniques:
  - "Open redirect"
  - "Evasion"
detection_methods:
  - "Header analysis"
  - "URL analysis"
  - "Sender analysis"
id: "c0805b80-0524-5278-8848-f720d58571c2"