Attachment: Google share.google URL shortener in google./share.google path form

calendar Sep 14, 2026  ·
Share on: linkedin copy

Detects inbound messages whose attachments contain links in the form google./share.google?q=, which inherits google. domain reputation to mask an attacker-controlled destination. This google./share.google?q= path form is undocumented: Google publishes the share.google shortener feature, but not this on-Google-domain form or its 'q' parameter. ICS calendar attachments are covered by a separate rule.

Sublime rule (View on GitHub)

 1name: "Attachment: Google share.google URL shortener in google.<tld>/share.google path form"
 2description: "Detects inbound messages whose attachments contain links in the form google.<tld>/share.google?q=<code>, which inherits google.<tld> domain reputation to mask an attacker-controlled destination. This google.<tld>/share.google?q= path form is undocumented: Google publishes the share.google shortener feature, but not this on-Google-domain form or its 'q' parameter. ICS calendar attachments are covered by a separate rule."
 3type: "rule"
 4severity: "medium"
 5source: |
 6  type.inbound
 7  and any(attachments,
 8          not (
 9            .file_type == "ics"
10            or .file_extension == "ics"
11            or .content_type in ("application/ics", "text/calendar")
12          )
13          and any(file.explode(.),
14                  any(.scan.url.urls,
15                      .domain.sld == "google"
16                      and strings.istarts_with(.path, '/share.google')
17                      and 'q' in keys(.query_params_decoded)
18                  )
19          )
20  )  
21attack_types:
22  - "Spam"
23  - "Credential Phishing"
24tactics_and_techniques:
25  - "Open redirect"
26  - "Social engineering"
27detection_methods:
28  - "URL analysis"
29  - "Content analysis"
30  - "File analysis"
31id: "840d7a90-3b3a-5fe1-a9c6-eac5deb4c14f"
to-top