Suspicious Google Doc Links

Use this query to find emails with message IDs that resemble IDs used in known attack emails and contain a link a document in Google Docs. These behaviors have been observed leading to ransomware attacks.