Link: Google Cloud Storage hex filename pattern

calendar Oct 22, 2026  ·
Share on: linkedin copy

Detects inbound emails containing links to storage.googleapis.com where the URL path consists of a hexadecimal hash followed by an .html extension, a pattern commonly used to host malicious or phishing content on this legitimate cloud storage service.

Sublime rule (View on GitHub)

 1name: "Link: Google Cloud Storage hex filename pattern"
 2description: "Detects inbound emails containing links to storage.googleapis.com where the URL path consists of a hexadecimal hash followed by an .html extension, a pattern commonly used to host malicious or phishing content on this legitimate cloud storage service."
 3type: "rule"
 4severity: "medium"
 5source: |
 6  type.inbound
 7  and any(body.links,
 8          strings.iends_with(.href_url.domain.domain, "storage.googleapis.com")
 9          and regex.imatch(.href_url.path, '/[a-f0-9]{8,32}\.html')
10  )  
11attack_types:
12  - "Credential Phishing"
13tactics_and_techniques:
14  - "Free file host"
15detection_methods:
16  - "URL analysis"
17id: "0e20d45a-36f1-594b-8d61-950bc00a5363"
to-top