EXPLORE
Sign In
← Back to Explore
sublimehighRule

Link: Flare-branded credential harvesting via Cloudflare tunnels

Detects inbound messages that begin with 'Flare' branding (such as FlareDoc, FlareAudio, FlareBill, FlareReport) and contain links to trycloudflare.com domains. This pattern represents a consistent actor template using Cloudflare tunnels for credential harvesting operations.

MITRE ATT&CK

T1566T1566.001T1566.002T1598
initial-access

Detection Query

type.inbound
and strings.starts_with(body.current_thread.text, 'Flare') 
and any(body.links, .href_url.domain.root_domain == "trycloudflare.com")

Data Sources

Email MessagesEmail HeadersEmail Attachments

Platforms

email
Raw Content
name: "Link: Flare-branded credential harvesting via Cloudflare tunnels"
description: "Detects inbound messages that begin with 'Flare' branding (such as FlareDoc, FlareAudio, FlareBill, FlareReport) and contain links to trycloudflare.com domains. This pattern represents a consistent actor template using Cloudflare tunnels for credential harvesting operations."
type: "rule"
severity: "high"
source: |
  type.inbound
  and strings.starts_with(body.current_thread.text, 'Flare') 
  and any(body.links, .href_url.domain.root_domain == "trycloudflare.com")
attack_types:
  - "Credential Phishing"
tactics_and_techniques:
  - "Free subdomain host"
  - "Social engineering"
detection_methods:
  - "Content analysis"
  - "URL analysis"
id: "ac81eaf3-cc29-5945-a3a8-2a57b3de441d"