Detects inbound messages where an attachment (excluding ICS calendar items) contains a URL matching a Google shortener form on a non-Google domain (google.<tld>/share.google) with a query parameter named q. The rule inspects the attached file content and, if a URL within decoded query parameters includes a path starting with /share.google and a q parameter, it flags potential abuse. This form appears undocumented and can be used to mask attacker-controlled destinations, enabling open redirects and social engineering campaigns. The rule focuses on inbound email/file attachments, triggers on the presence of such URLs, and is aligned with phishing-spam detection patterns via URL, content, and file analysis. ICS attachments are explicitly excluded to avoid calendar-related false positives.