Link: Google Cloud Storage /index and /unsub link pair

 1name: "Link: Google Cloud Storage /index and /unsub link pair"
 2description: "This rule detects inbound messages that abuse Google Cloud Storage (storage.googleapis.com) hosting by embedding exactly two distinct links that share the same bucket directory, with paths following an /index and /unsub pattern. This structure is commonly seen in bulk spam campaigns promoting wellness products, supplement pitches, or reward/loyalty offers, where the hosted content serves as a landing page and the second link mimics an unsubscribe mechanism to lend legitimacy. The use of a trusted cloud storage domain helps the messages evade reputation-based filtering while funneling recipients to spam content."
 3type: "rule"
 4severity: "medium"
 5source: |
 6  type.inbound
 7  // two distinct paths
 8  and length(distinct(map(filter(body.links,
 9                                 .href_url.domain.domain == "storage.googleapis.com"
10                          ),
11                          .href_url.path
12                      )
13             )
14  ) == 2
15  // they are exactly /<bucket>/index or /<bucket>/unsub
16  and all(distinct(map(filter(body.links,
17                              .href_url.domain.domain == "storage.googleapis.com"
18                       ),
19                       .href_url.path
20                   )
21          ),
22          regex.imatch(., '/[^/]+/(?:index|unsubv?)')
23  )
24  // all within the same bucket
25  and length(distinct(map(filter(body.links,
26                                 .href_url.domain.domain == "storage.googleapis.com"
27                          ),
28                          regex.extract(.href_url.path, '^/(?P<bucket>[^/]+)/')[0].named_groups["bucket"]
29                      )
30             )
31  ) == 1  
32tags:
33  - "Attack surface reduction"
34attack_types:
35  - "Spam"
36tactics_and_techniques:
37  - "Free file host"
38  - "Social engineering"
39detection_methods:
40  - "URL analysis"
41  - "Content analysis"
42id: "15739766-9335-5e84-973b-12503ded014e"