Attachment: ICS calendar invite with Google share.google URL shortener in google./share.google path form

calendar Sep 14, 2026  ·
Share on: linkedin copy

Detects inbound messages with ICS calendar invites containing links in the form google./share.google?q=, which inherits google. domain reputation to mask an attacker-controlled destination. This google./share.google?q= path form is undocumented: Google publishes the share.google shortener feature, but not this on-Google-domain form or its 'q' parameter.

Sublime rule (View on GitHub)

 1name: "Attachment: ICS calendar invite with Google share.google URL shortener in google.<tld>/share.google path form"
 2description: "Detects inbound messages with ICS calendar invites containing links in the form google.<tld>/share.google?q=<code>, which inherits google.<tld> domain reputation to mask an attacker-controlled destination. This google.<tld>/share.google?q= path form is undocumented: Google publishes the share.google shortener feature, but not this on-Google-domain form or its 'q' parameter."
 3type: "rule"
 4severity: "medium"
 5source: |
 6  type.inbound
 7  and any(attachments,
 8          (
 9            .file_type == "ics"
10            or .file_extension == "ics"
11            or .content_type in ("application/ics", "text/calendar")
12          )
13          //
14          // This rule makes use of a beta feature and is subject to change without notice
15          // using the beta feature in custom rules is not suggested until it has been formally released
16          //
17          and any(beta.file.parse_ics(.).events,
18                  any(.links,
19                      .href_url.domain.sld == "google"
20                      and strings.istarts_with(.href_url.path, '/share.google')
21                      and 'q' in keys(.href_url.query_params_decoded)
22                  )
23          )
24  )  
25attack_types:
26  - "Spam"
27  - "Credential Phishing"
28tactics_and_techniques:
29  - "Open redirect"
30  - "Social engineering"
31detection_methods:
32  - "URL analysis"
33  - "Content analysis"
34  - "File analysis"
35id: "49d95b8b-e2c6-5ac1-8a41-61afff9da2c2"
to-top