ClickFix payload hosting via Cloudflare R2/Pages infrastructure
This rule monitors proxy and network detection and response (NDR) logs for outbound HTTPS requests to Cloudflare R2 (*.r2.dev) and Cloudflare Pages (*.pages.dev) domains. These platforms are frequently abused by adversaries for hosting malicious payloads, particularly in ClickFix-style social engineering campaigns. The rule specifically flags connections that involve the download of common executable, script, or archive file extensions, as well as recurring traffic patterns to these domains.
Splunk (SPL)
