sublimehighRule

Link: Google Cloud Storage link with index.php in URL

Detects inbound messages containing links hosted on storage.googleapis.com that point to an index.php path, either in the URL path or fragment. Attackers abuse Google Cloud Storage to host malicious content, leveraging the trusted domain to bypass security filters.

MITRE ATT&CK

T1566 T1566.001 T1566.002 T1598 T1036 T1027

defense-evasion

Detection Query

type.inbound
and any(body.links,
        .href_url.domain.domain == "storage.googleapis.com"
        and (
          strings.iends_with(.href_url.path, 'index.php')
          or regex.icontains(.href_url.fragment, '^\/?index.php')
        )
)

Data Sources

Email MessagesEmail HeadersEmail Attachments

Platforms

Raw Content

name: "Link: Google Cloud Storage link with index.php in URL"
description: "Detects inbound messages containing links hosted on storage.googleapis.com that point to an index.php path, either in the URL path or fragment. Attackers abuse Google Cloud Storage to host malicious content, leveraging the trusted domain to bypass security filters."
type: "rule"
severity: "high"
source: |
  type.inbound
  and any(body.links,
          .href_url.domain.domain == "storage.googleapis.com"
          and (
            strings.iends_with(.href_url.path, 'index.php')
            or regex.icontains(.href_url.fragment, '^\/?index.php')
          )
  )
attack_types:
  - "Credential Phishing"
tactics_and_techniques:
  - "Evasion"
  - "Free file host"
  - "Open redirect"
detection_methods:
  - "URL analysis"
id: "d0ecb49a-6251-51b2-850e-b3503dd3d02f"