Sublime Security high experimental mql

Link: Google Cloud Storage impersonating with googledrive in URL path

Detects inbound messages containing links to Google Cloud Storage (storage.googleapis.com) with paths ending in 'googledrive.html', indicating abuse of Google's cloud storage service to impersonate Google Drive and potentially deliver malicious content.

View Source

Detection Logic

type.inbound
and any(body.links,
        // use of storage.googleapis.com
        .href_url.domain.domain == "storage.googleapis.com"
        // with an actor controlled path that impersonates Google Drive
        and strings.iends_with(.href_url.path, 'googledrive.html')
)

Field Validations

Loading…

Comments (0)

Loading comments...