sublimemediumRule

Open redirect: JustPaste.it

Detects inbound messages containing JustPaste.it redirect links that forward to external destinations outside of JustPaste.it. This technique abuses JustPaste.it's redirect functionality to obscure the true destination URL, bypassing link reputation checks. The rule excludes legitimate senders from JustPaste.it itself.

MITRE ATT&CK

T1566 T1566.001 T1566.002 T1598 T1204.002 T1486 T1036 T1027

defense-evasion

Detection Query

type.inbound
and any(body.links,
        .href_url.domain.domain == "justpaste.it"
        and strings.istarts_with(.href_url.path, '/redirect/')
        // wrapped destination is not back to justpaste.it
        and not strings.icontains(.href_url.path, 'justpaste.it')
)
and not sender.email.domain.root_domain == "justpaste.it"

Data Sources

Email MessagesEmail HeadersEmail Attachments

Platforms

Raw Content

name: "Open redirect: JustPaste.it"
description: "Detects inbound messages containing JustPaste.it redirect links that forward to external destinations outside of JustPaste.it. This technique abuses JustPaste.it's redirect functionality to obscure the true destination URL, bypassing link reputation checks. The rule excludes legitimate senders from JustPaste.it itself."
type: "rule"
severity: "medium"
source: |
  type.inbound
  and any(body.links,
          .href_url.domain.domain == "justpaste.it"
          and strings.istarts_with(.href_url.path, '/redirect/')
          // wrapped destination is not back to justpaste.it
          and not strings.icontains(.href_url.path, 'justpaste.it')
  )
  and not sender.email.domain.root_domain == "justpaste.it"   
attack_types:
  - "Credential Phishing"
  - "Malware/Ransomware"
tactics_and_techniques:
  - "Open redirect"
  - "Free file host"
  - "Evasion"
detection_methods:
  - "URL analysis"
  - "Sender analysis"
id: "faff6efd-c644-58f1-b856-fd707cf8c9b9"