Open redirect: YouTube

name: "Open redirect: YouTube"
description: |
  Looks for use of the YouTube open redirect coming from someone other than YouTube.
type: "rule"
severity: "medium"
authors:
  - twitter: "vector_sec"
source: |
  type.inbound
  and (
    any(body.links,
        .href_url.domain.sld == "youtube"
        and (
          strings.icontains(.href_url.url, "attribution_link?")
          or .href_url.path == "/redirect"
        )
    )
    or any(attachments,
           (
             .file_extension in~ $file_extensions_macros
             or .file_extension in~ $file_extensions_common_archives
             or (
               .file_extension is null
               and .file_type == "unknown"
               and .content_type == "application/octet-stream"
               and .size < 100000000
             )
           )
           and any(file.oletools(.).relationships,
                   .name == "hyperlink"
                   and .target_url.domain.sld == "youtube"
                   and (
                     strings.icontains(.target_url.path, "attribution_link?")
                     or .target_url.path == "/redirect"
                   )
           )
    )
  )
  and headers.auth_summary.dmarc.details.from.root_domain == "youtube.com"
  
  // negate highly trusted sender domains unless they fail DMARC authentication
  and (
    (
      sender.email.domain.root_domain in $high_trust_sender_root_domains
      and not headers.auth_summary.dmarc.pass
    )
    or sender.email.domain.root_domain not in $high_trust_sender_root_domains
  )
  and (
    not profile.by_sender().solicited
    or profile.by_sender().any_messages_malicious_or_spam
  )

tags:
  - "Attack surface reduction"
attack_types:
  - "Credential Phishing"
  - "Malware/Ransomware"
tactics_and_techniques:
  - "Open redirect"
detection_methods:
  - "Sender analysis"
  - "URL analysis"
id: "fb33bffe-d3db-5acb-ae19-5ddc6b5b0b01"