Low Severity
Link: Google Translate (unsolicited)
Description
Attackers have used the Google Translate service to deliver links to malicious sites repackaged with a translate.goog top-level domain. This rule identifies instances of Google Translate links from unsolicited senders.
type.inbound
and any(body.links, "google_translate_open_redirect" in .href_url.rewrite.encoders)
and (
not profile.by_sender().solicited
or profile.by_sender().any_messages_malicious_or_spam
)
and not profile.by_sender().any_false_positives
Playground
Test against your own EMLs or sample data.