svn commit: r1934484 - spamassassin/trunk/rulesrc/sandbox/fkento

Author: fkento
Date: Thu May 21 17:29:06 2026
New Revision: 1934484

Log:
Add rule to detect Microsoft OAuth authorize endpoint redirector abuse

Modified:
   spamassassin/trunk/rulesrc/sandbox/fkento/20_misc.cf

Modified: spamassassin/trunk/rulesrc/sandbox/fkento/20_misc.cf
==============================================================================
--- spamassassin/trunk/rulesrc/sandbox/fkento/20_misc.cf	Thu May 21 17:28:05 2026	(r1934483)
+++ spamassassin/trunk/rulesrc/sandbox/fkento/20_misc.cf	Thu May 21 17:29:06 2026	(r1934484)
@@ -43,3 +43,9 @@ describe      FKO_GOOGLE_LUCKY  Google "
 
 uri           FKO_DDG_DUCKY  /^https?:\/\/(?:www\.)?duckduckgo\.com\/?\?(?:.*&)?q=!ducky/i
 describe      FKO_DDG_DUCKY  DuckDuckGo "I'm feeling ducky" search
+
+uri           __FKO_MS_OAUTH_SILENT  /^https?:\/\/login\.microsoftonline\.com\/[^\/?\#]+\/oauth2\/(?:v2\.0\/)?authorize\?(?:[^"\s]*&)?prompt=none(?:&|$)/i
+uri           __FKO_MS_OAUTH_FAKE_URI  /^https?:\/\/login\.microsoftonline\.com\/[^\/?\#]+\/oauth2\/(?:v2\.0\/)?authorize\?(?:[^"\s]*&)?uri=https?(?::|%3A)/i
+meta          FKO_MS_OAUTH_REDIR_ABUSE  __FKO_MS_OAUTH_SILENT && __FKO_MS_OAUTH_FAKE_URI
+score         FKO_MS_OAUTH_REDIR_ABUSE  0.1
+describe      FKO_MS_OAUTH_REDIR_ABUSE  Microsoft OAuth authorize endpoint abused as a phishing redirector