Detection rules › Sublime MQL
Attachment: EML with QR code redirecting to Cloudflare challenges
Detects EML attachments containing office documents, PDFs, or images with embedded QR codes that redirect to Cloudflare challenge pages, potentially used to bypass security measures.
Threat classification
Sublime's own taxonomy (not MITRE ATT&CK).
| Category | Values |
|---|---|
| Attack types | Credential Phishing, Malware/Ransomware |
| Tactics and techniques | Evasion, QR code |
Event coverage
| Message attribute |
|---|
| recipients |
| recipients.to (collection) |
| type |
Rule body MQL
type.inbound
and length(recipients.to) == 1
and recipients.to[0].email.domain.valid
and any(attachments,
// Email Attachments
any(file.parse_eml(.).attachments,
(
// looks for office docs in the attached eml
.file_extension in $file_extensions_macros
and any(file.explode(.),
.scan.qr.type == "url"
and regex.icontains(ml.link_analysis(.scan.qr.url).final_dom.raw,
'challenges\.cloudflare\.com',
)
)
)
or (
// looks for pdfs and images in the attached eml
//
// This rule makes use of a beta feature and is subject to change without notice
// using the beta feature in custom rules is not suggested until it has been formally released
//
any(beta.scan_qr(.).items,
.type is not null
and regex.icontains(ml.link_analysis(.url).final_dom.raw,
'challenges\.cloudflare\.com'
)
)
)
)
)
Detection logic
Scope: inbound message.
Detects EML attachments containing office documents, PDFs, or images with embedded QR codes that redirect to Cloudflare challenge pages, potentially used to bypass security measures.
- inbound message
- length(recipients.to) is 1
- recipients.to[0].email.domain.valid
any of
attachmentswhere:any of
file.parse_eml(.).attachmentswhere any holds:all of:
- .file_extension in $file_extensions_macros
any of
file.explode(.)where all hold:- .scan.qr.type is 'url'
- ml.link_analysis(.scan.qr.url).final_dom.raw matches 'challenges\\.cloudflare\\.com'
any of
beta.scan_qr(.).itemswhere all hold:- .type is set
- ml.link_analysis(.url).final_dom.raw matches 'challenges\\.cloudflare\\.com'
Inspects: recipients.to, recipients.to[0].email.domain.valid, type.inbound. Sensors: beta.scan_qr, file.explode, file.parse_eml, ml.link_analysis, regex.icontains. Reference lists: $file_extensions_macros.
Indicators matched (2)
| Field | Match | Value |
|---|---|---|
file.explode(file.parse_eml(attachments[]).attachments[])[].scan.qr.type | equals | url |
regex.icontains | regex | challenges\.cloudflare\.com |