Sublime Security medium experimental mql

Attachment: PDF Attachment with links to workers.dev

Detects inbound messages containing PDF attachments with fewer than 5 pages that, when analyzed, contain URLs pointing to workers.dev subdomains. This pattern indicates potential abuse of Cloudflare Workers infrastructure to host malicious content delivered via PDF documents.

View Source

Detection Logic

type.inbound
and any(filter(attachments, .file_type == "pdf"),
        beta.parse_exif(.).page_count <= 2
        and any(file.explode(.),
                any(.scan.url.urls, .domain.root_domain == "workers.dev")
        )
)

Field Validations

Loading…

Comments (0)

Loading comments...