Medium Severity
Link to Google Apps Script macro (unsolicited)
Description
Message contains a Google Apps Script macro link. App Scripts can run arbitrary code, including redirecting the user to a malicious web page.
Sublime Security
Created Aug 17th, 2023 • Last updated Oct 4th, 2023
Feed Source
Sublime Core Feed
Source
type.inbound
and any(body.links,
.href_url.domain.domain == "script.google.com" and strings.ilike(.href_url.path, "/macros*")
)
and (
profile.by_sender().prevalence in ("new", "outlier")
or (
profile.by_sender().any_messages_malicious_or_spam
and not profile.by_sender().any_false_positives
)
)
Playground
Test against your own EMLs or sample data.