Message Sender

Attribute group	Sample	Rule
sender	Y	Y
sender.email	Y	Y

`sender`

Description

Message Data Model attribute: sender

Fields #

Name	Description
display_name	Display name

Example Message Record #

{
  "sender": {
    "display_name": "HR tyrellcorp <noreply@tyrellcorp.io>",
    "email": {
      "domain": {
        "domain": "tyrellcorp.io",
        "root_domain": "tyrellcorp.io",
        "sld": "tyrellcorp",
        "tld": "io",
        "valid": true
      },
      "email": "rachael@tyrellcorp.io",
      "local_part": "rachael"
    }
  }
}

Common Indicators #

Positive field/value combinations most frequently checked by detection rules targeting this event, derived from cross-vendor predicate analysis. This is separate from Fields accounting, which also includes exclusions and counts distinct attached rules.

Field	Kind	Value	Rules	Vendors
`headers.reply_to`	length_compare	`0`	12 rules	mql
`beta.ocr`	func_call	`beta.ocr(file.message_screenshot()).text !=`	7 rules	mql
`subject.subject`	regex_match	`termination.*notice`	7 rules	mql
`subject.subject`	regex_match	`38417`	6 rules	mql
`subject.subject`	regex_match	`:completed`	6 rules	mql
`subject.subject`	regex_match	`[il1]{2}mit.*ma[il1]{2} ?bo?x`	6 rules	mql
`subject.subject`	regex_match	`[il][il][il]egai[ -]`	6 rules	mql
`subject.subject`	regex_match	`[li][li][li]ega[li] attempt`	6 rules	mql
`subject.subject`	regex_match	`[ng]-?[io]n .*block`	6 rules	mql
`subject.subject`	regex_match	`[ng]-?[io]n .*cancel`	6 rules	mql
`subject.subject`	regex_match	`[ng]-?[io]n .*deactiv`	6 rules	mql
`subject.subject`	regex_match	`[ng]-?[io]n .*disabl`	6 rules	mql
`subject.subject`	regex_match	`abandon.*package`	6 rules	mql
`subject.subject`	regex_match	`about.your.account`	6 rules	mql
`subject.subject`	regex_match	`acc(ou)?n?t (is )?on ho[li]d`	6 rules	mql

Detection Rules #

Full rule details for this event, including ATT&CK technique mappings and native queries →

Sublime MQL #

Service abuse: DocuSign notification with suspicious sender or document name source medium: The detection rule is intended to match on messages sent from Docusign from a newly observed reply-to address which contains suspicious content within the document or sender display name.↳ also matches sender.email
Service Abuse: ExactTarget with suspicious sender indicators source high: Message originates from ExactTarget infrastructure but uses a suspicious sender domain, including overly long salesforce.com domains, awsapps.com domains, domains containing UTF-8 encoding characters, or a suspicious sender display name.↳ also matches sender.email
Service Abuse: HelloSign share with suspicious sender or document name source medium: The detection rule is designed to identify messages sent from HelloSign that notify recipients about a shared file and contain suspicious content either in the document or the sender's display name.↳ also matches sender.email

Show 17 more (226 total) on the rules page

`sender.email`

Description

Message Data Model attribute: sender.email

Fields #

Name	Description
domain
domain.domain	The fully qualified domain name (FQDN). This may not always be routable, e.g. when an email address contains a domain that is just a TLD with no SLD, e.g. foo@WIN-bar
domain.root_domain	The root domain, including the TLD
domain.sld	Second-level domain, e.g. 'windows' for the domain 'windows.net'
domain.subdomain	Subdomain, e.g. 'drive' for the domain 'drive.google.com'
domain.tld	The domain's top-level domain. E.g. the TLD of google.com is 'com'
domain.valid	Whether the domain is valid
email	Full email address
local_part	Local-part, i.e. before the @

Example Message Record #

{
  "sender.email": {
    "domain": {
      "domain": "tyrellcorp.io",
      "root_domain": "tyrellcorp.io",
      "sld": "tyrellcorp",
      "tld": "io",
      "valid": true
    },
    "email": "rachael@tyrellcorp.io",
    "local_part": "rachael"
  }
}

Common Indicators #

Field	Kind	Value	Rules	Vendors
`type.inbound`	eq	`true`	752 rules	mql
`profile.by_sender`	func_call	`profile.by_sender().any_messages_malicious_or_spam`	124 rules	mql
`profile.by_sender`	func_call	`profile.by_sender().prevalence in (new, outlier)`	34 rules	mql
`attachments`	length_compare	`0`	69 rules	mql
`body.links`	length_compare	`0`	66 rules	mql
`body.links`	length_compare	`10`	39 rules	mql
`recipients.to`	length_compare	`1`	52 rules	mql
`recipients.to`	length_compare	`0`	36 rules	mql
`headers.references`	length_compare	`0`	40 rules	mql
`headers.in_reply_to`	is_null		39 rules	mql
`type.outbound`	eq	`true`	38 rules	mql
`headers.auth_summary.dmarc.pass`	eq	`true`	35 rules	mql
`headers.auth_summary.spf.pass`	eq	`true`	31 rules	mql
`headers.reply_to`	length_compare	`0`	30 rules	mql
`recipients.cc`	length_compare	`0`	25 rules	mql

Detection Rules #

Full rule details for this event, including ATT&CK technique mappings and native queries →

Sublime MQL #

Service abuse: Adobe Sign notification from an unsolicited reply-to address source medium: Identifies messages appearing to come from Adobe Sign signature notifications that contain a reply-to address not previously seen in organizational communications. This tactic exploits trust in legitimate Adobe services while attempting to establish unauthorized communication channels.
Service abuse: Amazon invitation with suspected callback phishing source medium: Detects Amazon's no-reply address with a subject about invitation sending, containing phone numbers within HTML header elements. This pattern is commonly used to trick recipients into calling fraudulent customer service numbers.
Service abuse: Behance document sharing with suspicious language source medium: Detects messages containing document sharing language with a single Behance gallery link, potentially indicating abuse of the legitimate Adobe Behance platform for malicious purposes.

Show 17 more (793 total) on the rules page

Message Sender

sender

Description

Fields #

Example Message Record #

Common Indicators #

Detection Rules #

Sublime MQL #

sender.email

Description

Fields #

Example Message Record #

Common Indicators #

Detection Rules #

Sublime MQL #

References #

`sender`

`sender.email`