detection.wiki

Detection rules › Sublime MQL

Abuse: Cloudflare Workers Hosted EvilTokens Domain Structure

Severity
high
Type
rule
Source
github.com/sublime-security/sublime-rules

Detects messages containing links to Cloudflare Workers domains that follow naming patterns designed to impersonate legitimate services such as Adobe, DocuSign, OneDrive, SharePoint, and voicemail systems. These domains use suspicious alphanumeric identifiers and may be used to deceive recipients into believing they are accessing trusted services.

Threat classification

Sublime's own taxonomy (not MITRE ATT&CK).

CategoryValues
Attack typesCredential Phishing
Tactics and techniquesImpersonation: Brand, Evasion, Social engineering

Event coverage

Message attribute
body
body.links (collection)
recipients
recipients.to (collection)
type

Rule body MQL

type.inbound
and length(recipients.to) == 1
and recipients.to[0].email.domain.valid
and any(body.links,
        // eviltokens cloudflare workers domain struct
        (
          strings.iends_with(.href_url.domain.domain, '-account.workers.dev')
          and regex.icontains(.href_url.domain.domain,
                              '^(?:(?:page-)?adobe|calendar_invite|(?:page-)?docusign|fax|quarantine|onedrive|page-password|sharepoint|voicemail|index)-[a-z0-9]{3}\.[a-z0-9-]{3,}'
          )
        )
)

Detection logic

Scope: inbound message.

Detects messages containing links to Cloudflare Workers domains that follow naming patterns designed to impersonate legitimate services such as Adobe, DocuSign, OneDrive, SharePoint, and voicemail systems. These domains use suspicious alphanumeric identifiers and may be used to deceive recipients into believing they are accessing trusted services.

  1. inbound message
  2. length(recipients.to) is 1
  3. recipients.to[0].email.domain.valid
  4. any of body.links where all hold:
    • .href_url.domain.domain ends with '-account.workers.dev'
    • .href_url.domain.domain matches '^(?:(?:page-)?adobe|calendar_invite|(?:page-)?docusign|fax|quarantine|onedrive|page-password|sharepoint|voicemail|index)-[a-z0-9]{3}\\.[a-z0-9-]{3,}'

Inspects: body.links, body.links[].href_url.domain.domain, recipients.to, recipients.to[0].email.domain.valid, type.inbound. Sensors: regex.icontains, strings.iends_with.

Indicators matched (2)

FieldMatchValue
strings.iends_withsuffix-account.workers.dev
regex.icontainsregex^(?:(?:page-)?adobe|calendar_invite|(?:page-)?docusign|fax|quarantine|onedrive|page-password|sharepoint|voicemail|index)-[a-z0-9]{3}\.[a-z0-9-]{3,}