Open redirect: Google Web Light

 1name: "Open redirect: Google Web Light"
 2description: "Message contains use of the Google Web Light open redirect. Google Web Light was sunset on December 19 2022."
 3references:
 4  - "https://developers.google.com/search/updates#december-2022"
 5  - "https://untrustednetwork.net/en/2024/02/26/google-open-redirect/"
 6type: "rule"
 7severity: "medium"
 8authors:
 9  - twitter: "ajpc500"
10source: |
11  type.inbound
12  and any(body.links,
13          .href_url.domain.root_domain == "googleweblight.com"
14          and regex.match(.href_url.query_params, "(lite_url|u)=.*")
15  )
16  and (
17    not profile.by_sender().solicited
18    or profile.by_sender().any_messages_malicious_or_spam
19  )
20  and not profile.by_sender().any_messages_benign  
21tags:
22 - "Attack surface reduction"
23attack_types:
24  - "Credential Phishing"
25  - "Malware/Ransomware"
26tactics_and_techniques:
27  - "Open redirect"
28detection_methods:
29  - "Sender analysis"
30  - "URL analysis"
31
32id: "e185b530-5121-55f2-90ee-13e748914756"