Detection rules › Sublime MQL
Attachment: PDF Attachment with links to workers.dev
Detects inbound messages containing PDF attachments with fewer than 5 pages that, when analyzed, contain URLs pointing to workers.dev subdomains. This pattern indicates potential abuse of Cloudflare Workers infrastructure to host malicious content delivered via PDF documents.
Threat classification
Sublime's own taxonomy (not MITRE ATT&CK).
| Category | Values |
|---|---|
| Attack types | Credential Phishing |
| Tactics and techniques | PDF, Free subdomain host, Evasion |
Event coverage
| Message attribute |
|---|
| attachments (collection) |
| type |
Rule body MQL
type.inbound
and any(filter(attachments, .file_type == "pdf"),
beta.parse_exif(.).page_count <= 2
and any(file.explode(.),
any(.scan.url.urls, .domain.root_domain == "workers.dev")
)
)
Detection logic
Scope: inbound message.
Detects inbound messages containing PDF attachments with fewer than 5 pages that, when analyzed, contain URLs pointing to workers.dev subdomains. This pattern indicates potential abuse of Cloudflare Workers infrastructure to host malicious content delivered via PDF documents.
- inbound message
any of
filter(attachments)where all hold:- beta.parse_exif(.).page_count ≤ 2
any of
file.explode(.)where:any of
.scan.url.urlswhere:- .domain.root_domain is 'workers.dev'
Inspects: attachments[].file_type, type.inbound. Sensors: beta.parse_exif, file.explode.
Indicators matched (2)
| Field | Match | Value |
|---|---|---|
attachments[].file_type | equals | pdf |
file.explode(filter(attachments)[])[].scan.url.urls[].domain.root_domain | equals | workers.dev |