Detection rules › Sublime MQL
Link: Credential theft with Cloudflare tunnel and recipient targeting
Detects messages containing credential theft language and links to trycloudflare.com tunnels that include the recipient's email address in the URL path, indicating personalized targeting for credential harvesting.
Threat classification
Sublime's own taxonomy (not MITRE ATT&CK).
| Category | Values |
|---|---|
| Attack types | Credential Phishing |
| Tactics and techniques | Social engineering, Evasion |
Event coverage
| Message attribute |
|---|
| body.current_thread |
| recipients.to (collection) |
| type |
Rule body MQL
type.inbound
and any(ml.nlu_classifier(body.current_thread.text).intents,
.name == 'cred_theft' and .confidence != 'low'
)
and any(body.current_thread.links,
.href_url.domain.root_domain == 'trycloudflare.com'
and strings.icontains(.href_url.path, recipients.to[0].email.email)
)
Detection logic
Scope: inbound message.
Detects messages containing credential theft language and links to trycloudflare.com tunnels that include the recipient's email address in the URL path, indicating personalized targeting for credential harvesting.
- inbound message
any of
ml.nlu_classifier(body.current_thread.text).intentswhere all hold:- .name is 'cred_theft'
- .confidence is not 'low'
any of
body.current_thread.linkswhere all hold:- .href_url.domain.root_domain is 'trycloudflare.com'
- strings.icontains(.href_url.path)
Inspects: body.current_thread.links, body.current_thread.links[].href_url.domain.root_domain, body.current_thread.links[].href_url.path, body.current_thread.text, recipients.to[0].email.email, type.inbound. Sensors: ml.nlu_classifier, strings.icontains.
Indicators matched (2)
| Field | Match | Value |
|---|---|---|
ml.nlu_classifier(body.current_thread.text).intents[].name | equals | cred_theft |
body.current_thread.links[].href_url.domain.root_domain | equals | trycloudflare.com |