Attachment: RTF with link to free-hosted Cloudflare Pages

calendar Aug 13, 2026  ·
Share on: linkedin copy

Detects inbound emails that contain an RTF attachment. The rule extracts embedded content from the RTF file and inspects any URLs found within it, following redirects and analyzing the final destination page's links. It flags cases where those links point to domains hosted on the free Cloudflare Pages service (pages.dev), a common tactic used to host malicious or deceptive content while evading detection.

Sublime rule (View on GitHub)

 1name: "Attachment: RTF with link to free-hosted Cloudflare Pages"
 2description: "Detects inbound emails that contain an RTF attachment. The rule extracts embedded content from the RTF file and inspects any URLs found within it, following redirects and analyzing the final destination page's links. It flags cases where those links point to domains hosted on the free Cloudflare Pages service (pages.dev), a common tactic used to host malicious or deceptive content while evading detection."
 3type: "rule"
 4severity: "high"
 5source: |
 6  type.inbound
 7  and any(filter(attachments, .file_type == 'rtf'),
 8          any(file.explode(.),
 9              any(.scan.url.urls,
10                  any(ml.link_analysis(.).final_dom.links,
11                      .href_url.domain.root_domain in ('pages.dev')
12                  )
13              )
14          )
15  )  
16attack_types:
17  - "Credential Phishing"
18tactics_and_techniques:
19  - "Free subdomain host"
20detection_methods:
21  - "File analysis"
22  - "URL analysis"
23  - "HTML analysis"
24  - "Sender analysis"
25id: "017a97cc-4a5c-5475-8fa2-5e89a491c36c"
to-top