Create link_multiple_http_protocols_in_single_url.yml #3027
Conversation
github-actions
bot
added
the
in-test-rules
Negating discovered FP's
|
Looking through test results, i had a couple ideas to improve this idea. After noticing the test-rules results matched when many different URL query params each contained a single URL, the idea was that the URLs should be within a single URL query param. I had to reconstruct some of the functionality provided by query_params_decoded, but I think this worked well. Once I was able to narrow the matches down to a single query param i relized it's really different domains of the URLs that was interesting. I was able to reduce FPs by extracting the domain out of the "embedded" url and then ensure they were different and not the same as the sender domain, then count the number of unique domains embedded in the query param. Hunt and proposed MQL: https://platform.sublime.security/messages/hunt?huntId=01990742-61de-7a2f-a468-1ac9f785cf0a |
|
looks like the addition of the unsubscribe negation had a very positive impact on this rule, will continue testing for a bit more |
- Applied .github directory from main to morriscode-patch-46 - Ensures workflows and GitHub configurations are up to date - Automated sync via script
3 participants
Description
New ASR coverage for heavy link obfuscation through multiple redirection/security services.