Sync from PR#604

Adding PDF scanning to LinkedIn open redirect rule by @aidenmitchell
#604
Source SHA 5e96073
Triggered by @jkamdjou

detection-rules/open_redirect_linkedin.yml

@@ -0,0 +1,15 @@
+name: "Open redirect: Linkedin"
+description: "Detects emails containing links using Linkedin '/slink?code=xxxxx' open redirect where the email has not come from Linkedin.com"
+references:
+  - "https://krebsonsecurity.com/2022/02/how-phishers-are-slinking-their-links-into-linkedin/"
+type: "rule"
+authors:
+  - twitter: "xNymia"
+severity: "medium"
+source: "type.inbound\nand (\n    (\n        sender.email.domain.root_domain != \"linkedin.com\"\n        and any(body.links, .href_url.domain.root_domain == 'linkedin.com' and .href_url.path == '/slink')\n        and any(body.links, strings.ilike(.href_url.query_params, 'code=*'))\n    )\n    or any(attachments, .file_type == \"pdf\"\n        and any(file.explode(.), \n            any(.scan.url.urls, .domain.root_domain == 'linkedin.com' and .path == '/slink')\n            and any(.scan.url.urls, strings.ilike(.query_params, 'code=*'))\n        )\n    )\n)\n"
+tags:
+  - "Open redirect"
+  - "Suspicious link"
+id: "5ad2ffae-fca7-58ff-90bd-8efbd98c0a72"
+testing_pr: 604
+testing_sha: 5e9607399c93fbce8b756095bd9c450318638ef4