Link: Google Cloud Storage object named after its bucket

 1name: "Link: Google Cloud Storage object named after its bucket"
 2description: "Detects Google Cloud Storage links where the HTML object repeats the bucket name, a known actor-controlled hosting pattern. Observed in affiliate spam and account notice lures."
 3type: "rule"
 4severity: "medium"
 5source: |
 6  type.inbound
 7  and any(body.links,
 8          .href_url.domain.domain == "storage.googleapis.com"
 9          and regex.match(.href_url.path, '/[^/]+/[^/]+\.html')
10          and strings.starts_with(.href_url.path,
11                                  strings.concat('/',
12                                                 regex.extract(.href_url.path,
13                                                               '^/[^/]+/(?P<o>[^/]+)\.html$'
14                                                 )[0].named_groups["o"],
15                                                 '/'
16                                  )
17          )
18  )  
19attack_types:
20  - "Spam"
21tactics_and_techniques:
22  - "Free file host"
23  - "Evasion"
24detection_methods:
25  - "URL analysis"
26id: "2cfbd7e8-2b09-5163-9838-5c89fdb09155"