Detection rules › Sublime MQL

Link: Credential theft with Cloudflare tunnel and recipient targeting

Severity
high
Type
rule
Source
github.com/sublime-security/sublime-rules

Detects messages containing credential theft language and links to trycloudflare.com tunnels that include the recipient's email address in the URL path, indicating personalized targeting for credential harvesting.

Threat classification

Sublime's own taxonomy (not MITRE ATT&CK).

CategoryValues
Attack typesCredential Phishing
Tactics and techniquesSocial engineering, Evasion

Event coverage

Rule body MQL

type.inbound
and any(ml.nlu_classifier(body.current_thread.text).intents,
        .name == 'cred_theft' and .confidence != 'low'
)
and any(body.current_thread.links,
        .href_url.domain.root_domain == 'trycloudflare.com'
        and strings.icontains(.href_url.path, recipients.to[0].email.email)
)

Detection logic

Scope: inbound message.

Detects messages containing credential theft language and links to trycloudflare.com tunnels that include the recipient's email address in the URL path, indicating personalized targeting for credential harvesting.

  1. inbound message
  2. any of ml.nlu_classifier(body.current_thread.text).intents where all hold:
    • .name is 'cred_theft'
    • .confidence is not 'low'
  3. any of body.current_thread.links where all hold:
    • .href_url.domain.root_domain is 'trycloudflare.com'
    • strings.icontains(.href_url.path)

Inspects: body.current_thread.links, body.current_thread.links[].href_url.domain.root_domain, body.current_thread.links[].href_url.path, body.current_thread.text, recipients.to[0].email.email, type.inbound. Sensors: ml.nlu_classifier, strings.icontains.

Indicators matched (2)

FieldMatchValue
ml.nlu_classifier(body.current_thread.text).intents[].nameequalscred_theft
body.current_thread.links[].href_url.domain.root_domainequalstrycloudflare.com