Open redirect: Google Web Light

 1name: "Open redirect: Google Web Light"
 2description: "Message contains use of the Google Web Light open redirect. Google Web Light was sunset on December 19 2022."
 3references:
 4  - "https://developers.google.com/search/updates#december-2022"
 5  - "https://untrustednetwork.net/en/2024/02/26/google-open-redirect/"
 6type: "rule"
 7severity: "medium"
 8authors:
 9  - twitter: "ajpc500"
10source: |
11  type.inbound
12  and any(body.links,
13          .href_url.domain.root_domain == "googleweblight.com"
14          and regex.match(.href_url.query_params, "(lite_url|u)=.*")
15          
16  )
17  and (
18    not profile.by_sender().solicited
19    or profile.by_sender().any_messages_malicious_or_spam
20  )
21  and not profile.by_sender().any_false_positives  
22tags:
23 - "Attack surface reduction"
24attack_types:
25  - "Credential Phishing"
26  - "Malware/Ransomware"
27tactics_and_techniques:
28  - "Open redirect"
29detection_methods:
30  - "Sender analysis"
31  - "URL analysis"
32
33id: "e185b530-5121-55f2-90ee-13e748914756"