sublimehighRule

Link: Google Cloud Storage link with redirect.html in URL

Detects inbound messages containing links that route through a redirect.html page hosted on Google Cloud Storage (storage.googleapis.com). Attackers abuse legitimate cloud storage infrastructure to host redirect pages that forward victims to malicious destinations, evading URL reputation checks.

MITRE ATT&CK

T1566 T1566.001 T1566.002 T1598 T1036 T1027

defense-evasion

Detection Query

type.inbound
and any(body.links,
        (
          strings.iends_with(.href_url.path, 'redirect.html')
          or strings.istarts_with(.href_url.fragment,
                                  '/redirect.html',
                                  'redirect.html?'
          )
        )
        and .href_url.domain.domain == "storage.googleapis.com"
)

Data Sources

Email MessagesEmail HeadersEmail Attachments

Platforms

Raw Content

name: "Link: Google Cloud Storage link with redirect.html in URL"
description: "Detects inbound messages containing links that route through a redirect.html page hosted on Google Cloud Storage (storage.googleapis.com). Attackers abuse legitimate cloud storage infrastructure to host redirect pages that forward victims to malicious destinations, evading URL reputation checks."
type: "rule"
severity: "high"
source: |
  type.inbound
  and any(body.links,
          (
            strings.iends_with(.href_url.path, 'redirect.html')
            or strings.istarts_with(.href_url.fragment,
                                    '/redirect.html',
                                    'redirect.html?'
            )
          )
          and .href_url.domain.domain == "storage.googleapis.com"
  )
attack_types:
  - "Credential Phishing"
tactics_and_techniques:
  - "Evasion"
  - "Free file host"
  - "Open redirect"
detection_methods:
  - "URL analysis"
id: "2820ff89-7ae4-5fef-beac-86dc349ac0d8"