This rule detects credential phishing campaigns that reference Google Cloud Storage objects by inspecting inbound HTML content for links to storage.googleapis.com that match a specific object naming pattern. It evaluates inbound content (e.g., emails or web pages) and analyzes the links collection, requiring the link host to be storage.googleapis.com and the path to match the regex '/[a-z]+(?:-[a-z]+){2}-[a-z0-9]{10}/[a-z0-9]{20}\.html'. The pattern corresponds to an actor-generated bucket name comprised of three hyphenated words followed by a 10-character alphanumeric string, with an object filename of 20 alphanumeric characters ending in .html. A match triggers a high-severity alert associated with Credential Phishing, leveraging techniques such as evasion and the use of free file hosting services. The detection relies on URL analysis of inbound content. False positives may occur with legitimate hosted material; correlation with sender, context, and other indicators is advised. Recommended mitigations include consolidating email/link filtering policies, blocking or sandboxing matched storage.googleapis.com URLs, and educating users about phishing vectors employing cloud-hosted HTML content.