sublimehighRule

Link: Credential theft with Cloudflare tunnel and recipient targeting

Detects messages containing credential theft language and links to trycloudflare.com tunnels that include the recipient's email address in the URL path, indicating personalized targeting for credential harvesting.

MITRE ATT&CK

T1566 T1566.001 T1566.002 T1598 T1036 T1027

initial-accessdefense-evasion

Detection Query

type.inbound
and any(ml.nlu_classifier(body.current_thread.text).intents,
        .name == 'cred_theft' and .confidence != 'low'
)
and any(body.current_thread.links,
        .href_url.domain.root_domain == 'trycloudflare.com'
        and strings.icontains(.href_url.path, recipients.to[0].email.email)
)

Data Sources

Email MessagesEmail HeadersEmail Attachments

Platforms

Raw Content

name: "Link: Credential theft with Cloudflare tunnel and recipient targeting"
description: "Detects messages containing credential theft language and links to trycloudflare.com tunnels that include the recipient's email address in the URL path, indicating personalized targeting for credential harvesting."
type: "rule"
severity: "high"
source: |
  type.inbound
  and any(ml.nlu_classifier(body.current_thread.text).intents,
          .name == 'cred_theft' and .confidence != 'low'
  )
  and any(body.current_thread.links,
          .href_url.domain.root_domain == 'trycloudflare.com'
          and strings.icontains(.href_url.path, recipients.to[0].email.email)
  )

attack_types:
  - "Credential Phishing"
tactics_and_techniques:
  - "Social engineering"
  - "Evasion"
detection_methods:
  - "Natural Language Understanding"
  - "Content analysis"
  - "URL analysis"
id: "4d8919dd-238a-5381-b683-b4f5078e00da"