Sublime Security high experimental mql

Link: Google Cloud Storage with suspicious URL pattern

Detects inbound messages containing links to Google Cloud Storage (storage.googleapis.com) with suspicious URL path patterns that follow a specific actor-controlled structure commonly used for hosting malicious content.

View Source

Detection Logic

type.inbound
and any(body.links,
        // storage.googleapis.com
        .href_url.domain.domain == "storage.googleapis.com"
        // observed pattern in actor controlled url path
        and regex.contains(.href_url.path,
                           '^\/[a-z0-9]+-[a-z0-9]+-\d{8}\-[0-9a-f]+\/[^\.]+\.html'
        )
)

Field Validations

Loading…

Comments (0)

Loading comments...