Message Attachments
| Attribute group | Sample | Rule |
|---|---|---|
| attachments (collection) | N | Y |
attachments (collection)
#Description
Message Data Model attribute: attachments
Fields #
| Name | Description |
|---|---|
| content_disposition | Content-Disposition type, typically 'attachment' or 'inline' |
| content_id | Content-ID extracted from the MIME payload; is stripped of leading and trailing <> characters |
| content_type | Content-Type extracted from the MIME payload |
| file_extension | File extension from context such as headers |
| file_name | File name |
| file_type | File type determined by looking at the magic bytes in the file |
| md5 | MD5 hash of the raw contents |
| sha1 | SHA1 hash of the raw contents |
| sha256 | SHA256 hash of the raw contents |
| size | Size of the file in bytes |
Common Indicators #
Positive field/value combinations most frequently checked by detection rules targeting this event, derived from cross-vendor predicate analysis. This is separate from Fields accounting, which also includes exclusions and counts distinct attached rules.
| Field | Kind | Value | Rules | Vendors |
|---|---|---|---|---|
type.inbound | eq | true | 390 rules | mql |
profile.by_sender | func_call | profile.by_sender().any_messages_malicious_or_spam | 76 rules | mql |
profile.by_sender | func_call | profile.by_sender().prevalence in (new, outlier) | 17 rules | mql |
attachments | length_compare | 0 | 37 rules | mql |
attachments | length_compare | 1 | 29 rules | mql |
attachments | length_compare | 3 | 13 rules | mql |
body.current_thread.text | is_null | | 14 rules | mql |
body.current_thread.text | length_compare | 0 | 9 rules | mql |
body.current_thread.text | length_compare | 10 | 6 rules | mql |
profile.by_sender_email | func_call | profile.by_sender_email().any_messages_malicious_or_spam | 14 rules | mql |
profile.by_sender_email | func_call | profile.by_sender_email().prevalence in (new, outlier) | 8 rules | mql |
type.outbound | eq | true | 13 rules | mql |
filter(attachments, .file_type not in $file_types_images) | length_compare | 0 | 9 rules | mql |
filter(attachments, .file_type == 'pdf') | length_compare | 1 | 7 rules | mql |
sender.email.email | cross_field_compare | recipients.to[0].email.email | 7 rules | mql |
Detection Rules #
Full rule details for this event, including ATT&CK technique mappings and native queries →Sublime MQL #