Link: Google Cloud Storage with word-triple bucket and random HTML object

 1name: "Link: Google Cloud Storage with word-triple bucket and random HTML object"
 2description: "Detects Google Cloud Storage links using a known actor-generated bucket and object naming pattern. Observed in e-signature, wallet and account notice credential phishing."
 3type: "rule"
 4severity: "high"
 5source: |
 6  type.inbound
 7  and any(body.links,
 8          .href_url.domain.domain == "storage.googleapis.com"
 9          and regex.match(.href_url.path,
10                          '/[a-z]+(?:-[a-z]+){2}-[a-z0-9]{10}/[a-z0-9]{20}\.html'
11          )
12  )  
13attack_types:
14  - "Credential Phishing"
15tactics_and_techniques:
16  - "Free file host"
17  - "Evasion"
18detection_methods:
19  - "URL analysis"
20id: "3488c08a-068d-5650-9594-785da13e6df7"