Sublime Security medium experimental mql

Service abuse: Google OAuth with suspicious redirect destination

Detects messages containing Google OAuth links with prompt=none parameter that redirect to suspicious domains including free file hosts, free subdomain providers, or self-service creation platforms.

View Source

Detection Logic

type.inbound
and any(body.links,
        .href_url.domain.subdomain == "accounts"
        and .href_url.domain.sld == "google"
        and strings.istarts_with(.href_url.path, '/o/oauth2/v2/auth')
        and strings.icontains(.href_url.url, 'prompt=none')
)

Field Validations

Loading…

Comments (0)

Loading comments...