Link: Google share.google URL shortener in google./share.google path form

calendar Sep 14, 2026  ·
Share on: linkedin copy

Detects inbound messages with body links in the form google./share.google?q=, which inherits google. domain reputation to mask an attacker-controlled destination. This google./share.google?q= path form is undocumented: Google publishes the share.google shortener feature, but not this on-Google-domain form or its 'q' parameter.

Sublime rule (View on GitHub)

 1name: "Link: Google share.google URL shortener in google.<tld>/share.google path form"
 2description: "Detects inbound messages with body links in the form google.<tld>/share.google?q=<code>, which inherits google.<tld> domain reputation to mask an attacker-controlled destination. This google.<tld>/share.google?q= path form is undocumented: Google publishes the share.google shortener feature, but not this on-Google-domain form or its 'q' parameter."
 3type: "rule"
 4severity: "medium"
 5source: |
 6  type.inbound
 7  and any(body.links,
 8          .href_url.domain.sld == "google"
 9          and strings.istarts_with(.href_url.path, '/share.google')
10          and 'q' in keys(.href_url.query_params_decoded)
11  )  
12attack_types:
13  - "Spam"
14  - "Credential Phishing"
15tactics_and_techniques:
16  - "Open redirect"
17  - "Social engineering"
18detection_methods:
19  - "URL analysis"
20  - "Content analysis"
21id: "e29cd002-1624-5ff7-b05f-386ae5e4d115"
to-top