Sublime Security high experimental mql

Link: Google Cloud Storage link with index.php in URL

Detects inbound messages containing links hosted on storage.googleapis.com that point to an index.php path, either in the URL path or fragment. Attackers abuse Google Cloud Storage to host malicious content, leveraging the trusted domain to bypass security filters.

View Source

Detection Logic

type.inbound
and any(body.links,
        .href_url.domain.domain == "storage.googleapis.com"
        and (
          strings.iends_with(.href_url.path, 'index.php')
          or regex.icontains(.href_url.fragment, '^\/?index.php')
        )
)

Field Validations

Loading…

Comments (0)

Loading comments...