Detection rules › Sublime MQL
Suspicious Links to Cloudflare R2 and Edge Services
Detects links to Cloudflare R2 storage buckets, Pages, and Workers domains from unsolicited or previously malicious senders who are not on a trusted sender list or have failed DMARC authentication.
Threat classification
Sublime's own taxonomy (not MITRE ATT&CK).
| Category | Values |
|---|---|
| Attack types | BEC/Fraud, Callback Phishing, Credential Phishing, Extortion, Malware/Ransomware, Spam |
| Tactics and techniques | Free file host |
Event coverage
Rule body MQL
type.inbound
and any(body.links,
// Check root domain first
.href_url.domain.root_domain in ("r2.dev", "pages.dev", "workers.dev")
// Check the specific pub-{hex}.r2.dev subdomain pattern only for r2.dev
)
// negate emails with unsubscribe links
and not any(body.links,
strings.icontains(.href_url.url, "unsubscribe")
or strings.icontains(.display_text, "unsubscribe")
)
// negate bulk mailer domains
and not any(body.links,
.href_url.domain.root_domain in $bulk_mailer_url_root_domains
)
and not (
any(ml.nlu_classifier(body.current_thread.text).topics,
.name in (
"Newsletters and Digests",
"Advertising and Promotions",
"Educational and Research",
"B2B Cold Outreach",
"Health and Wellness",
"Professional and Career Development",
"Romance",
"Sexually Explicit Messages",
"Software and App Updates",
"Acts of Violence",
"Voicemail Call and Missed Call Notifications"
)
and .confidence == "high"
)
)
// negate highly trusted sender domains unless they fail DMARC authentication
and (
(
sender.email.domain.root_domain in $high_trust_sender_root_domains
and not headers.auth_summary.dmarc.pass
)
or sender.email.domain.root_domain not in $high_trust_sender_root_domains
)
and (
not profile.by_sender().solicited
or (
profile.by_sender().any_messages_malicious_or_spam
and not profile.by_sender().any_messages_benign
)
)
and not profile.by_sender().any_messages_benign
Detection logic
Scope: inbound message.
Detects links to Cloudflare R2 storage buckets, Pages, and Workers domains from unsolicited or previously malicious senders who are not on a trusted sender list or have failed DMARC authentication.
- inbound message
any of
body.linkswhere:- .href_url.domain.root_domain in ('r2.dev', 'pages.dev', 'workers.dev')
not:
any of
body.linkswhere any holds:- .href_url.url contains 'unsubscribe'
- .display_text contains 'unsubscribe'
not:
any of
body.linkswhere:- .href_url.domain.root_domain in $bulk_mailer_url_root_domains
not:
any of
ml.nlu_classifier(body.current_thread.text).topicswhere all hold:- .name in ('Newsletters and Digests', 'Advertising and Promotions', 'Educational and Research', 'B2B Cold Outreach', 'Health and Wellness', 'Professional and Career Development', 'Romance', 'Sexually Explicit Messages', 'Software and App Updates', 'Acts of Violence', 'Voicemail Call and Missed Call Notifications')
- .confidence is 'high'
any of:
all of:
- sender.email.domain.root_domain in $high_trust_sender_root_domains
not:
- headers.auth_summary.dmarc.pass
- sender.email.domain.root_domain not in $high_trust_sender_root_domains
any of:
not:
- profile.by_sender().solicited
all of:
- profile.by_sender().any_messages_malicious_or_spam
not:
- profile.by_sender().any_messages_benign
not:
- profile.by_sender().any_messages_benign
Inspects: body.current_thread.text, body.links, body.links[].display_text, body.links[].href_url.domain.root_domain, body.links[].href_url.url, headers.auth_summary.dmarc.pass, sender.email.domain.root_domain, type.inbound. Sensors: ml.nlu_classifier, profile.by_sender, strings.icontains. Reference lists: $bulk_mailer_url_root_domains, $high_trust_sender_root_domains.
Indicators matched (16)
| Field | Match | Value |
|---|---|---|
body.links[].href_url.domain.root_domain | member | r2.dev |
body.links[].href_url.domain.root_domain | member | pages.dev |
body.links[].href_url.domain.root_domain | member | workers.dev |
strings.icontains | substring | unsubscribe |
ml.nlu_classifier(body.current_thread.text).topics[].name | member | Newsletters and Digests |
ml.nlu_classifier(body.current_thread.text).topics[].name | member | Advertising and Promotions |
ml.nlu_classifier(body.current_thread.text).topics[].name | member | Educational and Research |
ml.nlu_classifier(body.current_thread.text).topics[].name | member | B2B Cold Outreach |
ml.nlu_classifier(body.current_thread.text).topics[].name | member | Health and Wellness |
ml.nlu_classifier(body.current_thread.text).topics[].name | member | Professional and Career Development |
ml.nlu_classifier(body.current_thread.text).topics[].name | member | Romance |
ml.nlu_classifier(body.current_thread.text).topics[].name | member | Sexually Explicit Messages |
4 more
ml.nlu_classifier(body.current_thread.text).topics[].name | member | Software and App Updates |
ml.nlu_classifier(body.current_thread.text).topics[].name | member | Acts of Violence |
ml.nlu_classifier(body.current_thread.text).topics[].name | member | Voicemail Call and Missed Call Notifications |
ml.nlu_classifier(body.current_thread.text).topics[].confidence | equals | high |