Suspicious message with unscannable Cloudflare link
This rule detects messages with unscannable links to cloudflare infrastructure with suspicious indicators in the subject or display name from an unsolicited sender.
Sublime rule (View on GitHub)
1name: "Suspicious message with unscannable Cloudflare link"
2description: "This rule detects messages with unscannable links to cloudflare infrastructure with suspicious indicators in the subject or display name from an unsolicited sender."
3type: "rule"
4severity: "medium"
5source: |
6 type.inbound
7 and (
8 (
9 // few links
10 0 < length(body.links) < 20
11 // fewer unique root domain links
12 and length(distinct(body.links, .href_url.domain.root_domain)) < 10
13 // sender domain matches no body domains
14 and all(body.links,
15 .href_url.domain.root_domain != sender.email.domain.root_domain
16 )
17 )
18 or beta.scan_qr(file.message_screenshot()).found
19 )
20
21 // negate bouncebacks and undeliverables
22 and not any(attachments,
23 .content_type in (
24 "message/global-delivery-status",
25 "message/delivery-status"
26 )
27 )
28
29 // suspicious subject or display name
30 and (
31 regex.icontains(subject.subject,
32 "termination.*notice",
33 "38417",
34 ":completed",
35 "[il1]{2}mit.*ma[il1]{2} ?bo?x",
36 "[il][il][il]egai[ -]",
37 "[li][li][li]ega[li] attempt",
38 "[ng]-?[io]n .*block",
39 "[ng]-?[io]n .*cancel",
40 "[ng]-?[io]n .*deactiv",
41 "[ng]-?[io]n .*disabl",
42 "action.*required",
43 "abandon.*package",
44 "about.your.account",
45 "acc(ou)?n?t (is )?on ho[li]d",
46 "acc(ou)?n?t.*terminat",
47 "acc(oun)?t.*[il1]{2}mitation",
48 "access.*limitation",
49 "account (will be )?block",
50 "account.*de-?activat",
51 "account.*locked",
52 "account.*re-verification",
53 "account.*security",
54 "account.*suspension",
55 "account.has.been",
56 "account.has.expired",
57 "account.will.be.blocked",
58 "account v[il]o[li]at",
59 "activity.*acc(oun)?t",
60 "almost.full",
61 "app[li]e.[il]d",
62 "authenticate.*account",
63 "been.*suspend",
64 "clos.*of.*account.*processed",
65 "confirm.your.account",
66 "courier.*able",
67 "crediential.*notif",
68 "deactivation.*in.*progress",
69 "delivery.*attempt.*failed",
70 "document.received",
71 "documented.*shared.*with.*you",
72 "dropbox.*document",
73 "e-?ma[il1]+ .{010}suspen",
74 "e-?ma[il1]{1} user",
75 "e-?ma[il1]{2} acc",
76 "e-?ma[il1]{2}.*up.?grade",
77 "e.?ma[il1]{2}.*server",
78 "e.?ma[il1]{2}.*suspend",
79 "email.update",
80 "faxed you",
81 "fraud(ulent)?.*charge",
82 "from.helpdesk",
83 "fu[il1]{2}.*ma[il1]+[ -]?box",
84 "has.been.*suspended",
85 "has.been.limited",
86 "have.locked",
87 "he[li]p ?desk upgrade",
88 "heipdesk",
89 "i[il]iega[il]",
90 "ii[il]ega[il]",
91 "incoming e?mail",
92 "incoming.*fax",
93 "lock.*security",
94 "ma[il1]{1}[ -]?box.*quo",
95 "ma[il1]{2}[ -]?box.*fu[il1]",
96 "ma[il1]{2}box.*[il1]{2}mit",
97 "ma[il1]{2}box stor",
98 "mail on.?hold",
99 "mail.*box.*migration",
100 "mail.*de-?activat",
101 "mail.update.required",
102 "mails.*pending",
103 "messages.*pending",
104 "missed.*shipping.*notification",
105 "missed.shipment.notification",
106 "must.update.your.account",
107 "new [sl][io]g?[nig][ -]?in from",
108 "new voice ?-?mail",
109 "notifications.*pending",
110 "office.*3.*6.*5.*suspend",
111 "office365",
112 "on google docs with you",
113 "online doc",
114 "password.*compromised",
115 "periodic maintenance",
116 "potential(ly)? unauthorized",
117 "refund not approved",
118 "report",
119 "revised.*policy",
120 "review.*document",
121 "scam",
122 "scanned.?invoice",
123 "secured?.update",
124 "security breach",
125 "securlty",
126 "signed.*delivery",
127 "statement is ready",
128 "status of your .{314}? ?delivery",
129 "susp[il1]+c[il1]+ous.*act[il1]+v[il1]+ty",
130 "suspicious.*sign.*[io]n",
131 "suspicious.activit",
132 "temporar(il)?y deactivate",
133 "temporar[il1]{2}y disab[li]ed",
134 "temporarily.*lock",
135 "un-?usua[li].activity",
136 "unable.*deliver",
137 "unauthorized.*activit",
138 "unauthorized.device",
139 "undelivered message",
140 "unread.*doc",
141 "unusual.activity",
142 "upgrade.*account",
143 "upgrade.notice",
144 "urgent message",
145 "urgent.verification",
146 "v[il1]o[li1]at[il1]on security",
147 "va[il1]{1}date.*ma[il1]{2}[ -]?box",
148 "verification ?-?require",
149 "verification( )?-?need",
150 "verify.your?.account",
151 "web ?-?ma[il1]{2}",
152 "web[ -]?ma[il1]{2}",
153 "will.be.suspended",
154 "your (customer )?account .as",
155 "your.office.365",
156 "your.online.access"
157 )
158 or any($suspicious_subjects, strings.icontains(subject.subject, .))
159 or regex.icontains(sender.display_name,
160 "Admin",
161 "Administrator",
162 "Alert",
163 "Assistant",
164 "Billing",
165 "Benefits",
166 "Bonus",
167 "CEO",
168 "CFO",
169 "CIO",
170 "CTO",
171 "Chairman",
172 "Claim",
173 "Confirm",
174 "Critical",
175 "Customer Service",
176 "Deal",
177 "Discount",
178 "Director",
179 "Exclusive",
180 "Executive",
181 "Fax",
182 "Free",
183 "Gift",
184 "/bHR/b",
185 "Helpdesk",
186 "Human Resources",
187 "Immediate",
188 "Important",
189 "Info",
190 "Information",
191 "Invoice",
192 '\bIT\b',
193 "Legal",
194 "Lottery",
195 "Management",
196 "Manager",
197 "Member Services",
198 "Notification",
199 "Offer",
200 "Operations",
201 "Order",
202 "Partner",
203 "Payment",
204 "Payroll",
205 "President",
206 "Premium",
207 "Prize",
208 "Receipt",
209 "Refund",
210 "Registrar",
211 "Required",
212 "Reward",
213 "Sales",
214 "Secretary",
215 "Security",
216 "Service",
217 "Signature",
218 "SSA",
219 "Storage",
220 "Support",
221 "Sweepstakes",
222 "System",
223 "Tax",
224 "Tech Support",
225 "Update",
226 "Upgrade",
227 "Urgent",
228 "Validate",
229 "Verify",
230 "VIP",
231 "Webmaster",
232 "Winner",
233 )
234 or any(body.links, strings.ends_with(.href_url.url, ".exe"))
235 or profile.by_sender_email().days_known < 1
236 )
237
238 // link can't be scanned due to Cloudflare captcha
239 and (
240 any(body.links,
241 (
242 strings.icontains(ml.link_analysis(., mode="aggressive").final_dom.display_text,
243 "cloudflare"
244 )
245 // includes the turnstile CAPTCHA
246 or (
247 strings.icontains(ml.link_analysis(., mode="aggressive").final_dom.raw,
248 'https://challenges.cloudflare.com/turnstile/'
249 )
250 // has a short body length indicating the page is gated behind the turnstile instead
251 // of just including the turnstile
252 and length((
253 ml.link_analysis(., mode="aggressive").final_dom.display_text
254 )
255 ) < 200
256 )
257 )
258 and not (
259 ( // a Cloudflare error page
260 strings.ilike(ml.link_analysis(., mode="aggressive").final_dom.display_text,
261 "*error code*"
262 )
263 and any(ml.link_analysis(., mode="aggressive").final_dom.links,
264 strings.icontains(.href_url.query_params,
265 "utm_source=errorcode"
266 )
267 )
268 ) // a cookie warning mentioning Cloudflare
269 or regex.icontains(ml.link_analysis(., mode="aggressive").final_dom.display_text,
270 "cookie.{0,50}Cloudflare"
271 )
272 or ml.link_analysis(., mode="aggressive").effective_url.domain.root_domain in (
273 "marketbeat.com"
274 )
275 )
276 )
277 or any(beta.scan_qr(file.message_screenshot()).items,
278 .type == "url"
279 and (
280 strings.icontains(ml.link_analysis(.url, mode="aggressive").final_dom.display_text,
281 "cloudflare"
282 )
283 // includes the turnstile CAPTCHA
284 or (
285 strings.icontains(ml.link_analysis(.url, mode="aggressive").final_dom.raw,
286 'https://challenges.cloudflare.com/turnstile/'
287 )
288 // has a short body length indicating the page is gated behind the turnstile instead
289 // of just including the turnstile
290 and length((
291 ml.link_analysis(.url, mode="aggressive").final_dom.display_text
292 )
293 ) < 200
294 )
295 )
296 and not (
297 ( // a Cloudflare error page
298 strings.ilike(ml.link_analysis(.url, mode="aggressive").final_dom.display_text,
299 "*error code*"
300 )
301 and any(ml.link_analysis(.url, mode="aggressive").final_dom.links,
302 strings.icontains(.href_url.query_params,
303 "utm_source=errorcode"
304 )
305 )
306 ) // a cookie warning mentioning Cloudflare
307 or regex.icontains(ml.link_analysis(.url, mode="aggressive").final_dom.display_text,
308 "cookie.{0,50}Cloudflare"
309 )
310 or ml.link_analysis(.url, mode="aggressive").effective_url.domain.root_domain in (
311 "marketbeat.com"
312 )
313 )
314 )
315 )
316 and (
317 not profile.by_sender_email().solicited
318 or (
319 profile.by_sender().any_messages_malicious_or_spam
320 and not profile.by_sender().any_messages_benign
321 )
322 )
323 // negate highly trusted sender domains unless they fail DMARC authentication
324 and not (
325 sender.email.domain.root_domain in $high_trust_sender_root_domains
326 and coalesce(headers.auth_summary.dmarc.pass, false)
327 )
328 and not profile.by_sender().any_messages_benign
329
330tags:
331 - "Attack surface reduction"
332attack_types:
333 - "Credential Phishing"
334detection_methods:
335 - "Content analysis"
336 - "Header analysis"
337 - "URL analysis"
338 - "Sender analysis"
339id: "70ea21f9-2a88-5e33-81a2-4f3384080a04"