Message Recipients

Attribute group	Sample	Rule
recipients	Y	Y
recipients.bcc (collection)	N	Y
recipients.cc (collection)	N	Y
recipients.to (collection)	Y	Y

`recipients`

Description

Message Data Model attribute: recipients

Fields #

Name	Description
bcc	List of 'bcc' Mailbox objects
cc	List of 'cc' Mailbox objects
to	List of 'to' Mailbox objects

Example Message Record #

{
  "recipients": {
    "to": [
      {
        "email": {
          "domain": {
            "domain": "tyrellcorp.io",
            "root_domain": "tyrellcorp.io",
            "sld": "tyrellcorp",
            "tld": "io",
            "valid": true
          },
          "email": "rachael@tyrellcorp.io",
          "local_part": "rachael"
        }
      }
    ]
  }
}

Common Indicators #

Positive field/value combinations most frequently checked by detection rules targeting this event, derived from cross-vendor predicate analysis. This is separate from Fields accounting, which also includes exclusions and counts distinct attached rules.

Field	Kind	Value	Rules	Vendors
`recipients.to`	length_compare	`1`	72 rules	mql
`recipients.to`	length_compare	`0`	40 rules	mql
`recipients.cc`	length_compare	`0`	28 rules	mql
`recipients.bcc`	length_compare	`0`	24 rules	mql
`sender.email.email`	cross_field_compare	`recipients.to[0].email.email`	21 rules	mql
`profile.by_sender_email`	func_call	`profile.by_sender_email().any_messages_malicious_or_spam`	14 rules	mql
`profile.by_sender_email`	func_call	`profile.by_sender_email().prevalence == new`	8 rules	mql
`profile.by_sender_email`	func_call	`profile.by_sender_email().prevalence in (new, outlier)`	7 rules	mql
`body.links`	length_compare	`10`	13 rules	mql
`recipients.to[0].email.domain.valid`	eq	`true`	13 rules	mql
`recipients.to[0].email.domain.valid`	eq	`false`	9 rules	mql
`attachments`	length_compare	`1`	12 rules	mql
`body.current_thread.text`	is_null		9 rules	mql
`body.current_thread.links`	length_compare	`0`	6 rules	mql
`body.current_thread.links`	length_compare	`10`	6 rules	mql

Detection Rules #

Full rule details for this event, including ATT&CK technique mappings and native queries →

Sublime MQL #

Abuse: Cloudflare Workers Hosted EvilTokens Domain Structure source high: Detects messages containing links to Cloudflare Workers domains that follow naming patterns designed to impersonate legitimate services such as Adobe, DocuSign, OneDrive, SharePoint, and voicemail systems. These domains use suspicious alphanumeric identifiers and may be used to deceive recipients into believing they are accessing trusted services.↳ also matches recipients.to (collection)
Attachment: Adobe image lure in body or attachment with suspicious link source medium: Detects Adobe phishing messages with an Adobe logo in the body or attachment, with suspicious link language.↳ also matches recipients.cc (collection), recipients.to (collection)
Brand impersonation: Adobe (QR code) source high: Detects messages using Adobe image based lures, referencing or including a QR code from an Unsolicited sender. These messages often lead users to phishing sites or initiate unwanted downloads.↳ also matches recipients.to (collection)

Show 17 more (187 total) on the rules page

References #

`recipients.bcc (collection)`

Description

Message Data Model attribute: recipients.bcc

Fields #

Name	Description
email.domain.root_domain	The root domain, including the TLD
email.local_part	Local-part, i.e. before the @

Common Indicators #

Field	Kind	Value	Rules	Vendors
`body.current_thread.text`	length_compare	`20`	1 rule	mql
`type.outbound`	eq	`true`	1 rule	mql

Detection Rules #

Full rule details for this event, including ATT&CK technique mappings and native queries →

Sublime MQL #

Credential phishing: Generic document share with unicode and proceedural greeting template source low: Detects messages that incorporate recipient-specific information (email domain, local part, domain elements or mailbox elements) alongside document-themed Unicode symbols and keywords. The rule identifies various targeting patterns including greeting-based personalization, attention-grabbing prefixes and multiple recipient elements. It also catches broken template attacks where recipient placeholders remain visible.↳ also matches recipients, recipients.to (collection)
Reconnaissance: Short generic greeting message source medium: Detects potential reconnaissance messages with very short, generic content like 'Hi' or 'Hello' from external senders. These messages are often used to validate email addresses and test deliverability before launching larger attacks. ↳ also matches recipients, recipients.cc (collection), recipients.to (collection)
beta.DLP: Outbound references an email address outside recipient domains source low: Detects outbound messages where an email address extracted from the subject, body, or attachments resolves to a domain different from every recipient's domain and not one of the sender's own domains. Catches email redirection patterns where content points to a third party not in the recipient list.↳ also matches recipients, recipients.cc (collection), recipients.to (collection)

References #

Sublime Message Data Model

`recipients.cc (collection)`

Description

Message Data Model attribute: recipients.cc

Fields #

Name	Description
display_name	Display name
email.domain.domain	The fully qualified domain name (FQDN). This may not always be routable, e.g. when an email address contains a domain that is just a TLD with no SLD, e.g. foo@WIN-bar
email.domain.root_domain	The root domain, including the TLD
email.domain.valid	Whether the domain is valid
email.email	Full email address
email.local_part	Local-part, i.e. before the @

Common Indicators #

Field	Kind	Value	Rules	Vendors
`recipients.cc`	length_compare	`1`	4 rules	mql
`body.current_thread.text`	contains	`kindly`	1 rule	mql
`type.outbound`	eq	`true`	1 rule	mql

Detection Rules #

Full rule details for this event, including ATT&CK technique mappings and native queries →

Sublime MQL #

Attachment: Adobe image lure in body or attachment with suspicious link source medium: Detects Adobe phishing messages with an Adobe logo in the body or attachment, with suspicious link language.↳ also matches recipients, recipients.to (collection)
Attachment: Encrypted PDF with credential theft language in EML source medium: Attached PDF is encrypted, and email body contains credential theft language, wrapped in an attached .eml file. Seen in-the-wild impersonating e-fax services.↳ also matches recipients, recipients.to (collection)
Attachment: QR code with userinfo portion source high: Detects inbound messages that contain image or document attachments with QR codes containing embedded usernames, passwords, or excessively padded URLs. This technique is used to bypass traditional text-based detection methods.↳ also matches recipients, recipients.to (collection)

Show 14 more (17 total) on the rules page

References #

Sublime Message Data Model

`recipients.to (collection)`

Description

Message Data Model attribute: recipients.to

Fields #

Name	Description
display_name	Display name
email.domain
email.domain.domain	The fully qualified domain name (FQDN). This may not always be routable, e.g. when an email address contains a domain that is just a TLD with no SLD, e.g. foo@WIN-bar
email.domain.root_domain	The root domain, including the TLD
email.domain.sld	Second-level domain, e.g. 'windows' for the domain 'windows.net'
email.domain.valid	Whether the domain is valid
email.email	Full email address
email.local_part	Local-part, i.e. before the @

Example Message Record #

{
  "recipients.to": [
    {
      "email": {
        "domain": {
          "domain": "tyrellcorp.io",
          "root_domain": "tyrellcorp.io",
          "sld": "tyrellcorp",
          "tld": "io",
          "valid": true
        },
        "email": "rachael@tyrellcorp.io",
        "local_part": "rachael"
      }
    }
  ]
}

Common Indicators #

Field	Kind	Value	Rules	Vendors
`recipients.to`	length_compare	`1`	66 rules	mql
`recipients.to`	length_compare	`0`	35 rules	mql
`recipients.cc`	length_compare	`0`	25 rules	mql
`recipients.cc`	length_compare	`1`	4 rules	mql
`recipients.bcc`	length_compare	`0`	23 rules	mql
`sender.email.email`	cross_field_compare	`recipients.to[0].email.email`	21 rules	mql
`recipients.to[0].email.domain.valid`	eq	`true`	15 rules	mql
`recipients.to[0].email.domain.valid`	eq	`false`	9 rules	mql
`profile.by_sender_email`	func_call	`profile.by_sender_email().any_messages_malicious_or_spam`	12 rules	mql
`profile.by_sender_email`	func_call	`profile.by_sender_email().prevalence == new`	8 rules	mql
`attachments`	length_compare	`1`	11 rules	mql
`body.current_thread.links`	length_compare	`0`	6 rules	mql
`body.current_thread.links`	length_compare	`10`	5 rules	mql
`recipients.to[0].email.email`	cross_field_compare	`sender.email.email`	6 rules	mql
`body.links`	length_compare	`1`	4 rules	mql

Detection Rules #

Full rule details for this event, including ATT&CK technique mappings and native queries →

Sublime MQL #

Abuse: Cloudflare Workers Hosted EvilTokens Domain Structure source high: Detects messages containing links to Cloudflare Workers domains that follow naming patterns designed to impersonate legitimate services such as Adobe, DocuSign, OneDrive, SharePoint, and voicemail systems. These domains use suspicious alphanumeric identifiers and may be used to deceive recipients into believing they are accessing trusted services.↳ also matches recipients
Attachment: Adobe image lure in body or attachment with suspicious link source medium: Detects Adobe phishing messages with an Adobe logo in the body or attachment, with suspicious link language.↳ also matches recipients, recipients.cc (collection)
Brand impersonation: Adobe (QR code) source high: Detects messages using Adobe image based lures, referencing or including a QR code from an Unsolicited sender. These messages often lead users to phishing sites or initiate unwanted downloads.↳ also matches recipients

Show 17 more (186 total) on the rules page