Google Drive direct download link from unsolicited sender

 1name: "Google Drive direct download link from unsolicited sender"
 2description: |
 3  This rule detects Google Drive links that use the direct download URL pattern which automatically downloads files when clicked. This pattern is frequently used by threat actors to distribute malware.
 4  
 5  The links are formatted like: drive.google.com/uc?id=FILE_ID&export=download
 6  
 7  These links skip the preview page and immediately download the file to the user's device, which can be dangerous for recipients. Threat actors exploit this pattern to directly distribute malware while appearing to share legitimate content from a trusted service.  
 8type: "rule"
 9severity: "medium"
10source: |
11  type.inbound
12  and 0 < length(body.links) < 10
13  and any(body.links,
14          (
15            // Match Google Drive direct download links
16            strings.icontains(.href_url.url, "drive.google.com/uc") 
17            and (
18              strings.icontains(.href_url.url, "export=download")
19              or strings.icontains(.href_url.query_params, "export=download")
20            )
21          )
22  )
23  // negate highly trusted sender domains unless they fail DMARC authentication
24  and not (
25    sender.email.domain.root_domain in $high_trust_sender_root_domains
26    and coalesce(headers.auth_summary.dmarc.pass, false)
27  )
28  and (
29    // Only trigger on unsolicited senders
30    not profile.by_sender().solicited
31    or (
32      // Or senders with suspicious history
33      profile.by_sender().any_messages_malicious_or_spam
34      and not profile.by_sender().any_messages_benign
35    )
36  )  
37
38tags:
39  - "Attack surface reduction"
40attack_types:
41  - "Malware/Ransomware"
42  - "Credential Phishing"
43tactics_and_techniques:
44  - "Evasion"
45  - "Social engineering"
46  - "Free file host"
47detection_methods:
48  - "URL analysis"
49  - "Sender analysis"
50  - "Content analysis"
51id: "78a19343-cfe7-5fd5-9816-dcb4293b705d"