Open Redirect: Google domain with /url path and suspicious indicators

calendar Jun 5, 2026  ·
Share on: linkedin copy

This rule examines messages containing image attachments that utilize Google's open redirect (google[.]com/url...). To enhance accuracy and minimize false positives, the rule conducts additional assessments for suspicious indicators, as indicated in the comments.

Sublime rule (View on GitHub)

 1name: "Open Redirect: Google domain with /url path and suspicious indicators"
 2description: |
 3  This rule examines messages containing image attachments that utilize Google's open redirect (google[.]com/url...). 
 4  To enhance accuracy and minimize false positives, the rule conducts additional assessments for suspicious indicators, as indicated in the comments.  
 5type: "rule"
 6severity: "medium"
 7source: |
 8  type.inbound
 9  // All attachments are images or 0 attachments
10  and (
11    (
12      length(attachments) > 0
13      and all(attachments, .file_type in $file_types_images)
14    )
15    or length(attachments) == 0
16  )
17  and sender.email.domain.root_domain not in $org_domains
18  // negate auth'ed google messages
19  and not (
20    sender.email.domain.sld == "google"
21    and sender.email.local_part in ("googlealerts-noreply", "comments-noreply")
22    and headers.auth_summary.spf.pass
23    and headers.auth_summary.dmarc.pass
24  )
25  // not a reply
26  and (length(headers.references) == 0 or headers.in_reply_to is null)
27  // With a Google Redirect
28  and any(body.links,
29          (
30            .href_url.domain.sld == "google"
31            and .href_url.path == "/url"
32            and regex.contains(.href_url.query_params, "hl=.{2}&q=http(s)?://")
33          )
34          or any(.href_url.rewrite.encoders, . == 'google_open_redirect')
35  )
36  and 2 of (
37    // Not a google logo
38    any(attachments,
39        .file_type in $file_types_images
40        and (
41          any(ml.logo_detect(.).brands, not strings.starts_with(.name, "Google"))
42          or any(ml.logo_detect(file.message_screenshot()).brands,
43                 not strings.starts_with(.name, "Google")
44          )
45        )
46    ),
47    // Body analysis - NLU - Credential theft
48    (
49      any(ml.nlu_classifier(body.current_thread.text).intents,
50          .name == "cred_theft" and .confidence in~ ("medium", "high")
51      )
52    ),
53    // Image analysis - NLU - Credential theft language
54    (
55      any(attachments,
56          .file_type in $file_types_images
57          and any(file.explode(.),
58                  any(ml.nlu_classifier(.scan.ocr.raw).intents,
59                      .name == "cred_theft"
60                  )
61          )
62      )
63    ),
64    // Content analysis - Body - Urgency
65    (
66      any(ml.nlu_classifier(body.current_thread.text).entities,
67          .name == "urgency"
68      )
69    ),
70  
71    // White font is found in html raw
72    (
73      length(body.html.display_text) < 500
74      and regex.icontains(body.html.raw,
75                          '<div style="color: #fff(fff)?.[^<]+<\/div><\/div><\/body><\/html>$'
76      )
77    )
78  
79    // domains using .app matching this pattern observed abusing google's redirect
80    or regex.icontains(sender.email.domain.domain,
81                       '[a-z]{3,}\.\d{5,}[^\.]+\.app$'
82    )
83  )  
84attack_types:
85  - "Credential Phishing"
86tactics_and_techniques:
87  - "Evasion"
88  - "Open redirect"
89detection_methods:
90  - "Computer Vision"
91  - "Content analysis"
92  - "File analysis"
93  - "Header analysis"
94  - "Natural Language Understanding"
95  - "Optical Character Recognition"
96  - "Sender analysis"
97  - "URL analysis"
98  
99id: "fc5adf74-6a39-5285-9737-3539a0542313"
to-top