Suspicious attachment with unscannable Cloudflare link
A PDF or Office document contains suspicious URLs that lead to Cloudflare-protected pages with turnstile CAPTCHA gates. The sender uses deceptive display names and subjects indicating urgency or authority.
Sublime rule (View on GitHub)
1name: "Suspicious attachment with unscannable Cloudflare link"
2description: "A PDF or Office document contains suspicious URLs that lead to Cloudflare-protected pages with turnstile CAPTCHA gates. The sender uses deceptive display names and subjects indicating urgency or authority."
3type: "rule"
4severity: "medium"
5source: |
6 type.inbound
7 and any(attachments,
8 (
9 .file_extension in $file_extensions_macros
10 or .file_extension == "pdf"
11 or .file_type in ("pdf", "doc", "docx", "xls", "xlsx")
12 or .content_type in ("application/pdf")
13 )
14 and any(file.explode(.),
15 // few links
16 0 < length(.scan.url.urls) < 20
17 // fewer unique root domain links
18 and length(distinct(.scan.url.urls, .domain.root_domain)) < 10
19 // sender domain matches no body domains
20 and all(.scan.url.urls,
21 .domain.root_domain != sender.email.domain.root_domain
22 )
23 )
24 )
25
26 // negate bouncebacks and undeliverables
27 and not any(attachments,
28 .content_type in (
29 "message/global-delivery-status",
30 "message/delivery-status"
31 )
32 )
33
34 // suspicious subject or display name
35 and (
36 regex.icontains(subject.subject,
37 "termination.*notice",
38 "38417",
39 ":completed",
40 "[il1]{2}mit.*ma[il1]{2} ?bo?x",
41 "[il][il][il]egai[ -]",
42 "[li][li][li]ega[li] attempt",
43 "[ng]-?[io]n .*block",
44 "[ng]-?[io]n .*cancel",
45 "[ng]-?[io]n .*deactiv",
46 "[ng]-?[io]n .*disabl",
47 "action.*required",
48 "abandon.*package",
49 "about.your.account",
50 "acc(ou)?n?t (is )?on ho[li]d",
51 "acc(ou)?n?t.*terminat",
52 "acc(oun)?t.*[il1]{2}mitation",
53 "access.*limitation",
54 "account (will be )?block",
55 "account.*de-?activat",
56 "account.*locked",
57 "account.*re-verification",
58 "account.*security",
59 "account.*suspension",
60 "account.has.been",
61 "account.has.expired",
62 "account.will.be.blocked",
63 "account v[il]o[li]at",
64 "activity.*acc(oun)?t",
65 "almost.full",
66 "app[li]e.[il]d",
67 "authenticate.*account",
68 "been.*suspend",
69 "clos.*of.*account.*processed",
70 "confirm.your.account",
71 "courier.*able",
72 "crediential.*notif",
73 "deactivation.*in.*progress",
74 "delivery.*attempt.*failed",
75 "document.received",
76 "documented.*shared.*with.*you",
77 "dropbox.*document",
78 "e-?ma[il1]+ .{010}suspen",
79 "e-?ma[il1]{1} user",
80 "e-?ma[il1]{2} acc",
81 "e-?ma[il1]{2}.*up.?grade",
82 "e.?ma[il1]{2}.*server",
83 "e.?ma[il1]{2}.*suspend",
84 "email.update",
85 "faxed you",
86 "fraud(ulent)?.*charge",
87 "from.helpdesk",
88 "fu[il1]{2}.*ma[il1]+[ -]?box",
89 "has.been.*suspended",
90 "has.been.limited",
91 "have.locked",
92 "he[li]p ?desk upgrade",
93 "heipdesk",
94 "i[il]iega[il]",
95 "ii[il]ega[il]",
96 "incoming e?mail",
97 "incoming.*fax",
98 "lock.*security",
99 "ma[il1]{1}[ -]?box.*quo",
100 "ma[il1]{2}[ -]?box.*fu[il1]",
101 "ma[il1]{2}box.*[il1]{2}mit",
102 "ma[il1]{2}box stor",
103 "mail on.?hold",
104 "mail.*box.*migration",
105 "mail.*de-?activat",
106 "mail.update.required",
107 "mails.*pending",
108 "messages.*pending",
109 "missed.*shipping.*notification",
110 "missed.shipment.notification",
111 "must.update.your.account",
112 "new [sl][io]g?[nig][ -]?in from",
113 "new voice ?-?mail",
114 "notifications.*pending",
115 "office.*3.*6.*5.*suspend",
116 "office365",
117 "on google docs with you",
118 "online doc",
119 "password.*compromised",
120 "periodic maintenance",
121 "potential(ly)? unauthorized",
122 "refund not approved",
123 "report",
124 "review.*document",
125 "revised.*policy",
126 "scam",
127 "scanned.?invoice",
128 "secured?.update",
129 "security breach",
130 "securlty",
131 "signed.*delivery",
132 "statement is ready",
133 "status of your .{314}? ?delivery",
134 "susp[il1]+c[il1]+ous.*act[il1]+v[il1]+ty",
135 "suspicious.*sign.*[io]n",
136 "suspicious.activit",
137 "temporar(il)?y deactivate",
138 "temporar[il1]{2}y disab[li]ed",
139 "temporarily.*lock",
140 "un-?usua[li].activity",
141 "unable.*deliver",
142 "unauthorized.*activit",
143 "unauthorized.device",
144 "undelivered message",
145 "unread.*doc",
146 "unusual.activity",
147 "upgrade.*account",
148 "upgrade.notice",
149 "urgent message",
150 "urgent.verification",
151 "v[il1]o[li1]at[il1]on security",
152 "va[il1]{1}date.*ma[il1]{2}[ -]?box",
153 "verification ?-?require",
154 "verification( )?-?need",
155 "verify.your?.account",
156 "web ?-?ma[il1]{2}",
157 "web[ -]?ma[il1]{2}",
158 "will.be.suspended",
159 "your (customer )?account .as",
160 "your.office.365",
161 "your.online.access"
162 )
163 or any($suspicious_subjects, strings.icontains(subject.subject, .))
164 or regex.icontains(sender.display_name,
165 "Admin",
166 "Administrator",
167 "Alert",
168 "Assistant",
169 "Billing",
170 "Benefits",
171 "Bonus",
172 "CEO",
173 "CFO",
174 "CIO",
175 "CTO",
176 "Chairman",
177 "Claim",
178 "Confirm",
179 "Critical",
180 "Customer Service",
181 "Deal",
182 "Discount",
183 "Director",
184 "Exclusive",
185 "Executive",
186 "Fax",
187 "Free",
188 "Gift",
189 "/bHR/b",
190 "Helpdesk",
191 "Human Resources",
192 "Immediate",
193 "Important",
194 "Info",
195 "Information",
196 "Invoice",
197 '\bIT\b',
198 "Legal",
199 "Lottery",
200 "Management",
201 "Manager",
202 "Member Services",
203 "Notification",
204 "Offer",
205 "Operations",
206 "Order",
207 "Partner",
208 "Payment",
209 "Payroll",
210 "President",
211 "Premium",
212 "Prize",
213 "Receipt",
214 "Refund",
215 "Registrar",
216 "Required",
217 "Reward",
218 "Sales",
219 "Secretary",
220 "Security",
221 "Service",
222 "Signature",
223 'SSA?\.gov',
224 "Storage",
225 "Support",
226 "Sweepstakes",
227 "System",
228 "Tax",
229 "Tech Support",
230 "Update",
231 "Upgrade",
232 "Urgent",
233 "Validate",
234 "Verify",
235 "VIP",
236 "Webmaster",
237 "Winner",
238 )
239 or any(attachments,
240 (
241 .file_extension in $file_extensions_macros
242 or .file_extension == "pdf"
243 or .file_type in ("pdf", "doc", "docx", "xls", "xlsx")
244 or .content_type in ("application/pdf")
245 )
246 and any(file.explode(.),
247 any(.scan.url.urls, strings.ends_with(.url, ".exe"))
248 or any(ml.nlu_classifier(.scan.ocr.raw).intents,
249 .name == "cred_theft"
250 )
251 )
252 )
253 )
254 and any(attachments,
255 (
256 .file_extension in $file_extensions_macros
257 or .file_extension == "pdf"
258 or .file_type in ("pdf", "doc", "docx", "xls", "xlsx")
259 or .content_type in ("application/pdf")
260 )
261 and any(file.explode(.),
262 any(.scan.url.urls,
263 (
264 strings.icontains(ml.link_analysis(., mode="aggressive").final_dom.display_text,
265 "cloudflare"
266 )
267 // includes the turnstile CAPTCHA
268 or (
269 strings.icontains(ml.link_analysis(., mode="aggressive").final_dom.raw,
270 'https://challenges.cloudflare.com/turnstile/'
271 )
272 // has a short body length indicating the page is gated behind the turnstile instead
273 // of just including the turnstile
274 and length((
275 ml.link_analysis(., mode="aggressive").final_dom.display_text
276 )
277 ) < 200
278 )
279 )
280 and not (
281 ( // a Cloudflare error page
282 strings.ilike(ml.link_analysis(., mode="aggressive").final_dom.display_text,
283 "*error code*"
284 )
285 and any(ml.link_analysis(., mode="aggressive").final_dom.links,
286 strings.icontains(.href_url.query_params,
287 "utm_source=errorcode"
288 )
289 )
290 ) // a cookie warning mentioning Cloudflare
291 or regex.icontains(ml.link_analysis(., mode="aggressive").final_dom.display_text,
292 "cookie.{0,50}Cloudflare"
293 )
294 or ml.link_analysis(., mode="aggressive").effective_url.domain.root_domain in (
295 "marketbeat.com"
296 )
297 )
298 )
299 )
300 )
301 and (
302 not profile.by_sender().solicited
303 or (
304 profile.by_sender().any_messages_malicious_or_spam
305 and not profile.by_sender().any_messages_benign
306 )
307 )
308
309 // negate highly trusted sender domains unless they fail DMARC authentication
310 and not (
311 sender.email.domain.root_domain in $high_trust_sender_root_domains
312 and coalesce(headers.auth_summary.dmarc.pass, false)
313 )
314 and not profile.by_sender().any_messages_benign
315tags:
316 - "Attack surface reduction"
317attack_types:
318 - "Credential Phishing"
319tactics_and_techniques:
320 - "Evasion"
321 - "PDF"
322 - "Social engineering"
323 - "Impersonation: Employee"
324 - "Impersonation: VIP"
325detection_methods:
326 - "File analysis"
327 - "URL analysis"
328 - "Sender analysis"
329 - "Content analysis"
330 - "Header analysis"
331 - "Natural Language Understanding"
332id: "00f92b6f-7449-5c93-ba29-b406c57bf121"