Link: Google Cloud Storage short filename pattern

calendar Sep 24, 2026  ·
Share on: linkedin copy

Detects inbound emails containing links to storage.googleapis.com where the URL path matches a suspicious pattern of a single-character folder followed by a one or two letter HTML filename (e.g., /x/ab.html). This naming convention is commonly used by phishing kits hosted on legitimate cloud storage to evade detection and obscure the true destination of the link.

Sublime rule (View on GitHub)

 1name: "Link: Google Cloud Storage short filename pattern"
 2description: "Detects inbound emails containing links to storage.googleapis.com where the URL path matches a suspicious pattern of a single-character folder followed by a one or two letter HTML filename (e.g., /x/ab.html). This naming convention is commonly used by phishing kits hosted on legitimate cloud storage to evade detection and obscure the true destination of the link."
 3type: "rule"
 4severity: "medium"
 5source: |
 6  type.inbound
 7  and any(body.links,
 8          .href_url.domain.domain == "storage.googleapis.com"
 9          and regex.imatch(.href_url.path, '/[^/]+/[a-z]{1,2}\.html')
10  )  
11attack_types:
12  - "Credential Phishing"
13tactics_and_techniques:
14  - "Free file host"
15  - "Evasion"
16detection_methods:
17  - "URL analysis"
18id: "ca9a907b-3984-5986-b6c3-58ffe8671af9"
to-top