Suspicious .workers.dev Domain Access After Email Click
This rule detects suspicious activity where a user clicks on a URL from an email and subsequently accesses a '.workers.dev' domain that contains keywords commonly associated with credential harvesting or malicious activity (e.g., 'docusign', 'onedrive', 'password_reset'). This pattern often indicates a phishing attempt where an attacker uses a Cloudflare Workers domain to host a malicious landing page.
Microsoft Sentinel (KQL)
