Sublime Security high experimental mql

Link: Google Cloud Storage link with redirect.html in URL

Detects inbound messages containing links that route through a redirect.html page hosted on Google Cloud Storage (storage.googleapis.com). Attackers abuse legitimate cloud storage infrastructure to host redirect pages that forward victims to malicious destinations, evading URL reputation checks.

View Source

Detection Logic

type.inbound
and any(body.links,
        (
          strings.iends_with(.href_url.path, 'redirect.html')
          or strings.istarts_with(.href_url.fragment,
                                  '/redirect.html',
                                  'redirect.html?'
          )
        )
        and .href_url.domain.domain == "storage.googleapis.com"
)

Field Validations

Loading…

Comments (0)

Loading comments...