Sublime Security high experimental mql

Link: Credential theft with Cloudflare tunnel and recipient targeting

Detects messages containing credential theft language and links to trycloudflare.com tunnels that include the recipient's email address in the URL path, indicating personalized targeting for credential harvesting.

View Source

Detection Logic

type.inbound
and any(ml.nlu_classifier(body.current_thread.text).intents,
        .name == 'cred_theft' and .confidence != 'low'
)
and any(body.current_thread.links,
        .href_url.domain.root_domain == 'trycloudflare.com'
        and strings.icontains(.href_url.path, recipients.to[0].email.email)
)

Field Validations

Loading…

Comments (0)

Loading comments...