Detection rules › By catalog entry

Sublime-Message-headers

Catalog entry	Rules
headers (collection)	278
headers.auth_summary	472
headers.domains (collection)	52
headers.hops (collection)	91
headers.ips (collection)	4
headers.reply_to (collection)	82
headers.return_path	38
headers.x_authenticated_domain	1
headers.x_authenticated_sender	1
headers.x_originating_ip	1

headers (collection)

278 detection rules reference this catalog entry. View catalog entry.

Sublime MQL (278)

Advance Fee Fraud (AFF) from freemail provider or suspicious TLD severity medium
AnonymousFox indicators severity high
Attachment with auto-executing macro (unsolicited) severity medium
Attachment: Adobe image lure in body or attachment with suspicious link severity medium
Attachment: Calendar invite with suspicious link leading to an open redirect severity high
Attachment: Callback phishing solicitation via image file severity high
Attachment: Callback phishing solicitation via pdf file severity high
Attachment: DocuSign impersonation via PDF linking to new domain severity medium
Attachment: EML file contains HTML attachment with login portal indicators severity high
Attachment: EML file with HTML attachment (unsolicited) severity medium
Attachment: EML with link to credential phishing page severity high
Attachment: EML with Sharepoint link likely unrelated to sender severity medium
Attachment: Encrypted PDF with credential theft body severity medium
Attachment: Encrypted PDF with credential theft language in EML severity medium
Attachment: Fake attachment image lure severity medium
Attachment: Fake secure message and suspicious indicators severity medium
Attachment: Invoice and W-9 PDFs with suspicious creators severity high
Attachment: Legal themed message or PDF with suspicious indicators severity medium
Attachment: Microsoft 365 credential phishing severity high
Attachment: Microsoft impersonation via PDF with link and suspicious language severity high
Attachment: Office document with VSTO add-in severity high
Attachment: PDF proposal with credential theft indicators severity high
Attachment: PDF with credential theft language and invalid reply-to domain severity medium
Attachment: RFC822 containing suspicious file sharing language with links from untrusted sender severity medium
Attachment: Romance scam with image lure and advance-fee or suspicious link indicators severity medium
BEC with unusual reply-to or return-path mismatch severity high
BEC/Fraud: Generic scam attempt to undisclosed recipients severity low
BEC/Fraud: Job scam fake thread or plaintext pivot to freemail severity medium
BEC/Fraud: Penpal scam severity medium
BEC/Fraud: Self-addressed reply with unrelated link in ongoing thread severity medium
BEC/Fraud: Urgent language and suspicious sending/infrastructure patterns severity medium
BEC: Tax document request severity medium
Benefits enrollment impersonation severity high
Body HTML: Recipient SLD in HTML class severity medium
Body: Embedded email headers indicative of thread hijacking/abuse severity medium
Body: HTML whitespace stuffing with short initial message severity medium
Brand impersonation: Adobe (QR code) severity high
Brand impersonation: Adobe Sign with suspicious indicators severity high
Brand impersonation: Adobe with suspicious language and link severity high
Brand impersonation: AliExpress severity medium
Brand impersonation: Amazon severity low
Brand impersonation: Aquent severity medium
Brand impersonation: Aramco severity medium
Brand impersonation: Booking.com severity medium
Brand impersonation: Box file sharing service severity medium
Brand impersonation: Capital One severity high
Brand impersonation: Cloud services with credential theft intent severity medium
Brand impersonation: DHL severity low
Brand impersonation: DocuSign severity high
Brand impersonation: DocuSign branded attachment lure with no DocuSign links severity high
Brand impersonation: Dropbox severity medium
Brand impersonation: Enbridge severity medium
Brand impersonation: Evite severity medium
Brand impersonation: Fake DocuSign HTML table not linking to DocuSign domains severity medium
Brand Impersonation: Gemini Trust Company severity medium
Brand impersonation: Github severity high
Brand Impersonation: Google (QR Code) severity high
Brand impersonation: Google Drive fake file share severity medium
Brand impersonation: Google using Microsoft Forms severity high
Brand impersonation: Google Workspace alert notification severity medium
Brand impersonation: Greenvelope severity medium
Brand impersonation: Greetings Island severity high
Brand impersonation: Internal Revenue Service severity high
Brand impersonation: LinkedIn severity medium
Brand impersonation: Mailchimp severity medium
Brand impersonation: Mailgun severity medium
Brand impersonation: Meta and subsidiaries severity medium
Brand impersonation: Microsoft severity high
Brand impersonation: Microsoft (QR code) severity high
Brand impersonation: Microsoft fake sign-in alert severity medium
Brand impersonation: Microsoft logo in HTML with fake quarantine release notification severity high
Brand impersonation: Microsoft logo or suspicious language with open redirect severity high
Brand impersonation: Microsoft Planner with suspicious link severity medium
Brand impersonation: Microsoft Teams invitation severity high
Brand impersonation: Microsoft with embedded logo and credential theft language severity high
Brand impersonation: Microsoft with low reputation links severity medium
Brand impersonation: Morgan Stanley severity medium
Brand impersonation: Norton severity low
Brand impersonation: Okta severity medium
Brand impersonation: Paperless Post severity high
Brand impersonation: PNC severity medium
Brand Impersonation: Procore severity medium
Brand impersonation: QuickBooks severity medium
Brand impersonation: QuickBooks notification from Intuit themed company name severity medium
Brand impersonation: Robert Half severity medium
Brand impersonation: Robinhood severity medium
Brand Impersonation: ShareFile severity medium
Brand impersonation: Sharepoint severity high
Brand impersonation: Sharepoint fake file share severity medium
Brand impersonation: SharePoint PDF attachment with credential theft language severity medium
Brand impersonation: Social Security Administration severity medium
Brand impersonation: SoFi severity medium
Brand Impersonation: Stripe severity high
Brand impersonation: TikTok severity medium
Brand impersonation: Twitter severity medium
Brand impersonation: UK government Home Office severity high
Brand impersonation: USPS severity high
Brand impersonation: Wix severity medium
Brand impersonation: Zoom severity medium
Brand spoof: Dropbox severity medium
Business Email Compromise (BEC) attempt from unsolicited sender severity medium
Business Email Compromise (BEC) attempt from untrusted sender severity medium
Business Email Compromise (BEC) attempt from untrusted sender (French/Français) severity medium
Business Email Compromise (BEC) attempt with masked recipients and reply-to mismatch (unsolicited) severity medium
Business Email Compromise (BEC) with request for mobile number severity medium
Business Email Compromise: Request for mobile number via reply thread hijacking severity medium
Callback phishing in body or attachment (untrusted sender) severity medium
Callback phishing solicitation in message body severity medium
Callback phishing via e-signature service severity high
Callback phishing via Intuit service abuse severity medium
Callback phishing: AOL senders with suspicious HTML template or PDF attachment severity high
Callback phishing: Branded invoice from sender/reply-to domain less than 30 days old severity medium
ClickFunnels link infrastructure abuse severity high
Compensation review with QR code in attached EML severity high
Constant Contact link infrastructure abuse severity high
COVID-19 themed fraud with sender and reply-to mismatch or compensation award severity medium
Credential phishing content and link (untrusted sender) severity high
Credential phishing language and suspicious indicators (unknown sender) severity medium
Credential phishing link (unknown sender) severity high
Credential phishing: 'Secure message' and engaging language severity medium
Credential phishing: Blue button styled link with file-sharing template artifacts severity low
Credential phishing: DocuSign embedded image lure with no DocuSign domains in links severity high
Credential phishing: Email delivery failure impersonation severity high
Credential phishing: Engaging language and other indicators (untrusted sender) severity medium
Credential phishing: Fake password expiration from new and unsolicited sender severity medium
Credential phishing: Fake storage alerts (unsolicited) severity medium
Credential phishing: Financial lure via ActiveCampaign infrastructure severity medium
Credential phishing: Generic document share with unicode and proceedural greeting template severity low
Credential phishing: Hyper-linked image leading to free file host severity medium
Credential phishing: Onedrive impersonation severity high
Credential phishing: Suspicious e-sign agreement document notification severity medium
Credential phishing: Suspicious subject with urgent financial request and link severity medium
Cyrillic vowel substitution in subject or display name from unknown sender severity medium
Cyrillic vowel substitutions with suspicious subject from unknown sender severity medium
Domain impersonation: Freemail reply-to local lookalike with financial request severity medium
EML attachment with credential theft language (unknown sender) severity high
Employee impersonation: Payroll fraud severity high
Encrypted Microsoft Office files from untrusted sender severity medium
Extortion / sextortion (untrusted sender) severity low
Extortion / sextortion in attachment from untrusted sender severity low
Fake email quarantine notification severity high
Fake message thread - Untrusted sender with a mismatched freemail reply-to address severity medium
Fake message thread with a suspicious link and engaging language from an unknown sender severity medium
Fake request for tax preparation severity high
Fake thread with suspicious indicators severity medium
Fake voicemail notification (untrusted sender) severity medium
Fake Zoom meeting invite with suspicious link severity medium
Fraudulent e-commerce operators severity high
Fraudulent order confirmation/shipping notification from Chinese sender domain severity medium
Free email provider sender with mismatched provider reply-to severity medium
Generic service abuse from newly registered domain severity high
Google share notification with suspicious comments severity high
Hardbacon infrastructure abuse severity high
Headers: Fake in-reply-to with wildcard sender and missing thread context severity high
Headers: Invalid recipient domain with mismatched reply-to from new sender severity medium
Headers: iOS/iPadOS mailer with invalid build number severity medium
Headers: Outlook Express mailer severity medium
Headers: risky-recover-production message ID severity low
Headers: Self-sender using Microsoft CompAuth bypass with credential theft content severity high
Headers: X-Source-Auth mismatch with mismatched reply-to domain severity high
Headers: Zimbra mailer from a non-supported OS version severity medium
Honorific greeting BEC attempt with sender and reply-to mismatch severity low
HR impersonation via e-sign agreement comment severity high
HTML smuggling containing recipient email address severity medium
Impersonation: Employee using fabricated identity in initial contact severity high
Impersonation: Human Resources with link or attachment and engaging language severity medium
Impersonation: Internal corporate services severity high
Impersonation: SharePoint reply header anomaly severity medium
Impersonation: Suspected supplier impersonation with suspicious content severity high
Inbound message from popular service via newly observed distribution list severity medium
Investor solicitation with organization targeting severity medium
Link: Apple TestFlight from suspicious sender severity medium
Link: Credential phishing traversing Russian infrastructure severity high
Link: Credential phishing via WordPress severity high
Link: Executable file download with suspicious message content severity high
Link: File sharing impersonation with suspicious language and sending patterns severity medium
Link: Free file hosting with undisclosed recipients severity medium
Link: Free subdomain host with undisclosed recipients severity medium
Link: Google Calendar invite linking to an open redirect from an untrusted freemail sender severity high
Link: Invalid reply-to with recipient details in subject, body, and encoded link severity medium
Link: Multistage landing - Abused Adobe Acrobat hosted PDF severity medium
Link: Multistage landing - Abused Google Drive severity high
Link: Multistage landing - Published Google Doc severity high
Link: Non-standard port 8443 in display URL severity medium
Link: Referrer anonymization service from untrusted sender severity medium
Link: Romance/Sexual Language With Suspicious Link severity low
Link: SharePoint files shared from GoDaddy federated tenants severity low
Link: SharePoint OneNote or PDF link with self sender behavior severity medium
Link: Squarespace infrastructure abuse severity medium
Link: Suspicious Sharepoint folder share severity high
Link: Uncommon SharePoint document type with sender's display name severity medium
Mass campaign: Cross Site Scripting (XSS) attempt severity medium
Message traversed multiple onmicrosoft.com tenants severity medium
Microsoft infrastructure abuse with suspicious patterns severity high
Newly registered sender or reply-to domain with newly registered linked domain severity medium
Observed IOC: Mail transiting bulletproof host - SmartApe severity medium
Observed IOC: Mail transiting OFAC-sanctioned bulletproof host Aeza Group severity high
Open redirect (go2.aspx) leading to Microsoft credential phishing severity medium
Open redirect: bubblelife.com severity medium
Open redirect: convertcart.com severity medium
Open redirect: embluemail.com severity medium
Open Redirect: Google domain with /url path and suspicious indicators severity medium
Open redirect: magic4media.com severity medium
Open redirect: pmifunds.com severity medium
Open redirect: predictiveresponse.net severity medium
Open redirect: qrxtech.com severity medium
Open redirect: secondstreetapp.com severity medium
Open redirect: Signature Travel Network severity medium
Open redirect: smartadserver.com severity medium
Open redirect: tuttocauzioni.it severity medium
Open redirect: weblinkconnect.com severity medium
PHP Mailer with common phishing attachments severity medium
QR Code with suspicious indicators severity high
Reconnaissance: Empty subject with mismatched reply-to from new sender severity medium
Reconnaissance: Hotel booking reply-to redirect severity medium
Request for Quote or Purchase (RFQ|RFP) with suspicious sender or recipient pattern severity medium
Salesforce infrastructure abuse severity medium
Scam: Fake estate sale offering welding equipment and tools severity high
Scam: Piano giveaway severity medium
Service abuse: AppSheet infrastructure with suspicious indicators severity medium
Service abuse: Cisco secure email service with financial request severity high
Service abuse: DocSend share from newly registered domain severity high
Service abuse: DocuSign notification with suspicious sender or document name severity medium
Service abuse: DocuSign share from an unsolicited reply-to address severity medium
Service abuse: Dropbox share from new domain severity medium
Service abuse: Dropbox share with suspicious sender or document name severity medium
Service Abuse: ExactTarget with suspicious sender indicators severity high
Service abuse: Free provider with SendGrid routing severity medium
Service abuse: GitHub notification with excessive mentions and suspicious links severity high
Service abuse: Google Drive share from an unsolicited reply-to address severity medium
Service abuse: Google Drive share from new reply-to domain severity medium
Service abuse: Google Firebase sender address with suspicious content severity low
Service abuse: HelloSign from an unsolicited sender address severity low
Service Abuse: HelloSign share with suspicious sender or document name severity medium
Service abuse: Kagoya.net-hosted domains sending English business lures severity low
Service abuse: Monday.com infrastructure with phishing intent severity high
Service abuse: Postman reply-to mismatch with credential theft intent severity medium
Service abuse: QuickBooks notification from new domain severity medium
Service abuse: Sendgrid credential theft with personalized request targeting single recipient severity medium
Service abuse: SendGrid impersonation via Sendgrid from new sender severity high
Service abuse: SendThisFile with credential theft and financial language severity medium
Service abuse: Soundestlink redirect with suspicious indicators severity medium
Service abuse: SurveyMonkey survey from newly registered domain severity high
Service abuse: Trello board invitation with VIP impersonation severity medium
Service abuse: Zohodesk reply-to mismatch with job scam indicators severity medium
SharePoint OTP for filename matching org name severity medium
Spam/fraud: Predatory journal/research paper request severity medium
Spam: BlackBaud infrastructure abuse severity medium
Spam: Default Microsoft Exchange Online sender domain (onmicrosoft.com) severity low
Spam: Fake dating profile notification severity low
Spam: Fake photo share severity low
Spam: Personalized subject and greetings via Salesforce Marketing Cloud severity low
Spam: Sendersrv.com with financial communications and unsubscribe language severity medium
Spam: Sexually explicit Google Drive share severity low
Spam: Sexually explicit Looker Studio report severity low
Spam: Single recipient duplicated in cc severity medium
Spam: Spoofed Outlook mailer with unsubscribe and reference ID footer severity low
Spamhaus: Mail transiting a DROP listed network severity medium
Spamhaus: Mail transiting an ASN-DROP listed network severity medium
SPF temp error severity medium
Spoofable internal domain with suspicious signals severity medium
Suspected cross-site scripting (XSS) found in subject severity medium
Suspicious DocuSign share from new domain severity high
Suspicious mailer received from Gmail servers severity low
Suspicious newly registered reply-to domain with engaging financial or urgent language severity medium
Suspicious recipients pattern with no Compauth pass and suspicious content severity medium
Suspicious request for financial information severity high
Suspicious SharePoint file sharing severity medium
Vendor compromise: GovDelivery message with suspicious link severity high
VIP / Executive impersonation (strict match, untrusted) severity high
VIP Impersonation via Google Group relay with suspicious indicators severity high
VIP impersonation with BEC language (near match, untrusted sender) severity medium
VIP impersonation with charitable donation fraud severity high
VIP impersonation with invoicing request severity high
VIP impersonation with urgent request (strict match, untrusted sender) severity high
VIP impersonation with w2 request with reply-to mismatch severity high
VIP impersonation: Fake thread with display name match, email mismatch severity medium
Xero infrastructure abuse severity medium

headers.auth_summary

472 detection rules reference this catalog entry. View catalog entry.

Sublime MQL (472)

Attachment: Adobe image lure in body or attachment with suspicious link severity medium
Attachment: Any .sap file (unsolicited) severity low
Attachment: Any HTML file (unsolicited) severity low
Attachment: Any HTML file (untrusted sender) severity medium
Attachment: Callback phishing solicitation via text-based file severity medium
Attachment: Compensation review lure with QR code severity high
Attachment: Compensation-themed DOCX with QR code credential theft severity high
Attachment: DocuSign impersonation via PDF linking to new domain severity medium
Attachment: EML file with HTML attachment (unsolicited) severity medium
Attachment: EML with Sharepoint link likely unrelated to sender severity medium
Attachment: EML with suspicious indicators severity medium
Attachment: Encrypted PDF with credential theft body severity medium
Attachment: Encrypted PDF with credential theft language in EML severity medium
Attachment: Fake attachment image lure severity medium
Attachment: Fake secure message and suspicious indicators severity medium
Attachment: Fake voicemail via PDF severity medium
Attachment: HTML attachment with login portal indicators severity medium
Attachment: HTML file with excessive 'const' declarations and abnormally long timeouts severity high
Attachment: HTML smuggling - QR Code with suspicious links severity high
Attachment: HTML smuggling with atob and high entropy severity high
Attachment: HTML smuggling with atob and high entropy via calendar invite severity high
Attachment: HTML smuggling with decimal encoding severity high
Attachment: HTML with emoji-to-character map severity high
Attachment: HTML with hidden body severity high
Attachment: HTML with JavaScript functions for HTTP requests severity high
Attachment: ICS calendar invite with financial lure and suspicious link severity medium
Attachment: ICS calendar with embedded file from internal sender with SPF failure severity high
Attachment: ICS file with credential theft indicators severity medium
Attachment: ICS voicemail lure with suspicious link severity medium
Attachment: Invoice and W-9 PDFs with suspicious creators severity high
Attachment: Microsoft 365 credential phishing severity high
Attachment: Microsoft impersonation via PDF with link and suspicious language severity high
Attachment: PDF proposal with credential theft indicators severity high
Attachment: PDF with credential theft language and invalid reply-to domain severity medium
Attachment: PDF with Microsoft Purview message impersonation severity medium
Attachment: PDF with suspicious HeadlessChrome metadata severity medium
Attachment: QR code with credential phishing indicators severity medium
Attachment: Risk assessment PDF with inline image severity high
Attachment: Suspicious employee policy update document lure severity medium
BEC with unusual reply-to or return-path mismatch severity high
BEC/Fraud: Generic scam attempt to undisclosed recipients severity low
BEC/Fraud: Penpal scam severity medium
BEC: Financial fraud from newly registered sender domain severity medium
BEC: Tax document request severity medium
Benefits enrollment impersonation severity high
Body HTML: Comment with 24-character hex token severity low
Body HTML: Recipient SLD in HTML class severity medium
Body: AI-generated invoice template artifacts severity medium
Body: Embedded email headers indicative of thread hijacking/abuse severity medium
Body: HTML whitespace stuffing with short initial message severity medium
Brand impersonation: AARP severity medium
Brand impersonation: Adobe (QR code) severity high
Brand impersonation: Adobe Sign with suspicious indicators severity high
Brand impersonation: Adobe with suspicious language and link severity high
Brand impersonation: AliExpress severity medium
Brand impersonation: Amazon severity low
Brand impersonation: Amazon Web Services (AWS) severity medium
Brand impersonation: American Express (AMEX) severity low
Brand impersonation: Anthropic/Claude with newly registered domain severity medium
Brand impersonation: Aquent severity medium
Brand impersonation: Aramco severity medium
Brand impersonation: AuthentiSign severity medium
Brand impersonation: Automobile assistance associations severity high
Brand impersonation: Bank of America severity high
Brand impersonation: Blockchain.com severity medium
Brand impersonation: Booking.com severity medium
Brand impersonation: Box file sharing service severity medium
Brand impersonation: Canada Revenue Agency severity medium
Brand impersonation: Capital One severity high
Brand impersonation: Charles Schwab severity medium
Brand impersonation: Chase Bank severity high
Brand impersonation: Chase bank with credential phishing indicators severity medium
Brand impersonation: Cloud services with credential theft intent severity medium
Brand impersonation: Coinbase severity high
Brand impersonation: Dashlane severity medium
Brand impersonation: DHL severity low
Brand impersonation: Discord notification severity medium
Brand Impersonation: Disney severity medium
Brand impersonation: DocSend severity high
Brand impersonation: DocuSign severity high
Brand impersonation: DocuSign (QR code) severity high
Brand impersonation: DocuSign with embedded QR code severity high
Brand impersonation: DoorDash severity medium
Brand impersonation: Dotloop severity medium
Brand impersonation: Dropbox severity medium
Brand impersonation: Evite severity medium
Brand impersonation: Fake Fax severity medium
Brand impersonation: Fastway severity medium
Brand impersonation: FedEx severity low
Brand impersonation: File sharing notification with template artifacts severity low
Brand Impersonation: Gemini Trust Company severity medium
Brand impersonation: Github severity high
Brand impersonation: GoDaddy severity medium
Brand impersonation: Google Careers severity high
Brand impersonation: Google Drive fake file share severity medium
Brand impersonation: Google Workspace alert notification severity medium
Brand impersonation: Government / Tax Authority document lure severity medium
Brand impersonation: Greenvelope severity medium
Brand impersonation: Greetings Island severity high
Brand impersonation: Gusto severity medium
Brand impersonation: Hulu severity medium
Brand impersonation: Interac severity medium
Brand impersonation: Internal Revenue Service severity high
Brand impersonation: KnowBe4 severity medium
Brand impersonation: LastPass severity high
Brand impersonation: Ledger severity low
Brand impersonation: Mailchimp severity medium
Brand impersonation: Mailgun severity medium
Brand impersonation: Marriott with gift language severity medium
Brand impersonation: McAfee severity medium
Brand impersonation: Meta and subsidiaries severity medium
Brand impersonation: MetaMask severity high
Brand impersonation: Microsoft severity high
Brand impersonation: Microsoft Planner with suspicious link severity medium
Brand impersonation: Microsoft quarantine release notification in body severity high
Brand impersonation: Microsoft quarantine release notification in image attachment severity high
Brand impersonation: Microsoft Teams invitation severity high
Brand impersonation: Microsoft with embedded logo and credential theft language severity high
Brand impersonation: Microsoft with low reputation links severity medium
Brand impersonation: Morgan Stanley severity medium
Brand impersonation: MyChart severity medium
Brand impersonation: Navan severity medium
Brand impersonation: Netflix severity low
Brand impersonation: Office 365 mail service severity medium
Brand impersonation: Okta severity medium
Brand Impersonation: OpenAI with ChatGPT Ads lure severity high
Brand impersonation: OpenAI with payment issues severity high
Brand impersonation: Paperless Post severity high
Brand Impersonation: PayPal severity medium
Brand impersonation: PNC severity medium
Brand Impersonation: Procore severity medium
Brand impersonation: Purdue ePlanroom with suspicious links severity medium
Brand impersonation: QuickBooks severity medium
Brand impersonation: QuickBooks dispute notification severity high
Brand impersonation: QuickBooks notification from Intuit themed company name severity medium
Brand impersonation: Robert Half severity medium
Brand impersonation: Robinhood severity medium
Brand impersonation: Sedgwick Claims severity medium
Brand impersonation: SendGrid severity medium
Brand Impersonation: ShareFile severity medium
Brand impersonation: Sharepoint severity high
Brand impersonation: Sharepoint fake file share severity medium
Brand impersonation: SharePoint PDF attachment with credential theft language severity medium
Brand Impersonation: Shein severity medium
Brand impersonation: SiriusXM severity medium
Brand impersonation: Social Security Administration severity medium
Brand impersonation: SoFi severity medium
Brand impersonation: Spotify severity low
Brand impersonation: Square severity medium
Brand impersonation: Squarespace severity medium
Brand impersonation: State Farm severity medium
Brand Impersonation: Stripe severity high
Brand impersonation: Stripe notification severity medium
Brand impersonation: Sublime Security severity high
Brand impersonation: Survey request with credential theft indicators severity medium
Brand impersonation: TikTok severity medium
Brand impersonation: Toronto-Dominion Bank severity medium
Brand impersonation: Trust Wallet severity high
Brand impersonation: TurboTax severity low
Brand impersonation: UK government Home Office severity high
Brand impersonation: United Healthcare severity medium
Brand impersonation: United States Patent and Trademark Office severity medium
Brand impersonation: UPS severity low
Brand impersonation: USPS severity high
Brand impersonation: Vanguard severity medium
Brand impersonation: Vanta severity low
Brand impersonation: Venmo severity medium
Brand impersonation: Wells Fargo severity high
Brand impersonation: WeTransfer severity high
Brand impersonation: Wise severity high
Brand impersonation: Wix severity medium
Brand impersonation: Xodo Sign severity medium
Brand impersonation: Zoom severity medium
Brand spoof: Dropbox severity medium
Business Email Compromise (BEC) attempt from unsolicited sender severity medium
Business Email Compromise (BEC) attempt from untrusted sender severity medium
Business Email Compromise (BEC) attempt from untrusted sender (French/Français) severity medium
Business Email Compromise: Request for mobile number via reply thread hijacking severity medium
Callback phishing in body or attachment (untrusted sender) severity medium
Callback phishing solicitation in message body severity medium
Callback phishing via Adobe Sign comment severity high
Callback phishing via calendar invite severity medium
Callback phishing via DocuSign comment severity high
Callback phishing via e-signature service severity high
Callback phishing via extensionless rfc822 attachment severity high
Callback phishing via Google Group abuse severity high
Callback phishing via Intuit service abuse severity medium
Callback Phishing via Signable E-Signature Request severity high
Callback phishing via SignFree e-signature request severity high
Callback phishing via Xodo Sign comment severity high
Callback phishing via Zoho service abuse severity medium
Callback Phishing via Zoom comment severity medium
Catbox.moe link from untrusted source severity medium
ClickFix: Clipboard hijack lure with copy-paste-to-terminal instruction severity high
Cloud storage impersonation with credential theft indicators severity medium
Commonly abused sender TLD with engaging language severity medium
Compensation review with QR code in attached EML severity high
Constant Contact link infrastructure abuse severity high
COVID-19 themed fraud with sender and reply-to mismatch or compensation award severity medium
Credential phishing content and link (untrusted sender) severity high
Credential phishing language and suspicious indicators (unknown sender) severity medium
Credential phishing link (unknown sender) severity high
Credential Phishing via Dropbox comment abuse severity medium
Credential phishing: 'Secure message' and engaging language severity medium
Credential Phishing: Bitcoin portfolio confirmation severity medium
Credential phishing: Blue button styled link with file-sharing template artifacts severity low
Credential phishing: DocuSign embedded image lure with no DocuSign domains in links severity high
Credential phishing: Email delivery failure impersonation severity high
Credential phishing: Engaging language and other indicators (untrusted sender) severity medium
Credential phishing: Fake card notification with tracking lure severity medium
Credential phishing: Fake password expiration from new and unsolicited sender severity medium
Credential phishing: Fake storage alerts (unsolicited) severity medium
Credential phishing: Financial lure via ActiveCampaign infrastructure severity medium
Credential phishing: Generic document share with unicode and proceedural greeting template severity low
Credential phishing: Generic document sharing severity medium
Credential phishing: Onedrive impersonation severity high
Credential phishing: Re-Authentication lure severity high
Credential phishing: Suspicious e-sign agreement document notification severity medium
Credential phishing: Suspicious subject with urgent financial request and link severity medium
Credential phishing: Tax form impersonation with payment request severity medium
Display name and subject impersonation using recipient SLD (new sender) severity medium
Display Name Emoji with Financial Symbols severity low
Display name impersonation using recipient SLD severity medium
DocuSign impersonation via spoofed Intuit sender severity high
EML attachment with credential theft language (unknown sender) severity high
Employee impersonation with urgent request (untrusted sender) severity medium
Extortion / sextortion (untrusted sender) severity low
Fake email quarantine notification severity high
Fake message thread with a suspicious link and engaging language from an unknown sender severity medium
Fake thread with suspicious indicators severity medium
Fake voicemail notification (untrusted sender) severity medium
Fake Zoom meeting invite with suspicious link severity medium
File sharing link with a suspicious subject severity medium
Free subdomain link with login or captcha (untrusted sender) severity medium
Google Drive direct download link from unsolicited sender severity medium
Google Notification alert link from non-Google sender severity medium
Google presentation open redirect phishing severity medium
Google services using g.co shortlinks severity medium
Google share notification with suspicious comments severity high
Hardbacon infrastructure abuse severity high
Headers: Self-sender using Microsoft CompAuth bypass with credential theft content severity high
Honorific greeting BEC attempt with sender and reply-to mismatch severity low
HR impersonation via e-sign agreement comment severity high
HTML smuggling containing recipient email address severity medium
Image as content with a link to an open redirect severity high
Impersonation using recipient domain (untrusted sender) severity medium
Impersonation: Chrome Web Store policy severity low
Impersonation: Fake Gmail attachment severity high
Impersonation: Fake product discount promotion severity medium
Impersonation: Human Resources with link or attachment and engaging language severity medium
Impersonation: Internal corporate services severity high
Impersonation: SAM/SBA federal registration severity high
Inbound message from popular service via newly observed distribution list severity medium
Job scam (unsolicited sender) severity low
Job scam with specific salary pattern severity low
Link to auto-downloaded DMG in archive severity medium
Link to auto-downloaded DMG in encrypted zip severity high
Link: .onion From Unsolicited Sender severity low
Link: Adobe share from unsolicited sender severity medium
Link: Adobe share with suspicious indicators severity high
Link: BEC with newly registered domains and financial keywords severity medium
Link: Common hidden directory observed severity medium
Link: Credential phishing link with undisclosed recipients severity medium
Link: Cryptocurrency fraud with suspicious links severity high
Link: Direct link to limewire hosted file severity high
Link: Direct link to riddle.com hosted showcase severity medium
Link: Direct link to Zoom Docs from non-Zoom sender severity medium
Link: Double base64-encoded URL path severity medium
Link: Executable file download with suspicious message content severity high
Link: Fake RFP/bid reference number lure severity medium
Link: File sharing impersonation with suspicious language and sending patterns severity medium
Link: Financial account issue with suspicious indicators severity medium
Link: Flagged bit.ly link severity medium
Link: Fraudulent state business filing notice severity medium
Link: Free file host links from suspicious support sender with credential theft language severity medium
Link: Free file hosting with undisclosed recipients severity medium
Link: GoPhish query param values severity low
Link: Hotel booking spoofed display URL severity medium
Link: IPFS severity medium
Link: Jensi file preview link from unsolicited sender severity medium
Link: Microsoft Dynamics 365 form phishing severity high
Link: Mismatched free file host links with document lure severity medium
Link: Mismatched Shopify template button href severity medium
Link: Multistage landing - Abused Docusign severity high
Link: Multistage landing - Abused Google Drive severity high
Link: Multistage landing - Ludus presentation severity medium
Link: Multistage landing - Scribd document severity medium
Link: Non-standard port 8443 in display URL severity medium
Link: Personalized URL with recipient address on commonly abused web service severity medium
Link: QR code with phishing disposition in img or pdf severity high
Link: QR Code with suspicious language (untrusted sender) severity medium
Link: QuickBooks image lure with suspicious link severity medium
Link: Recipient domain in URL path severity high
Link: Referrer anonymization service from untrusted sender severity medium
Link: Suspicious Sharepoint folder share severity high
Link: Suspicious wp-admin path from mismatched sender domain severity medium
Link: Tax document lure Portuguese/Spanish with suspicious domains severity medium
Link: Webflow link from unsolicited sender severity medium
Link: Zoho form link from unsolicited sender severity medium
Lookalike sender domain (untrusted sender) severity high
macOS malware: Compiled AppleScript with document double-extension severity high
Malware: Pikabot delivery via URL auto-download severity high
Mass campaign: recipient address in subject, body, and link (untrusted sender) severity medium
Message content: Request for author engagement severity low
Open redirect: adnxs.com severity medium
Open redirect: agena-smile.com severity medium
Open redirect: amaterasu-for-website-5.com severity medium
Open redirect: api.spently.com severity medium
Open redirect: Artisteer severity medium
Open redirect: artkaderne severity medium
Open Redirect: asemailmgmteu.com severity medium
Open redirect: astroarts.co.jp severity medium
Open redirect: bananaguide.com severity medium
Open redirect: bangkoksync.com severity medium
Open redirect: bestdeals.today severity medium
Open redirect: Bitrix24 URL Path severity medium
Open redirect: bubblelife.com severity medium
Open redirect: buildingengines.com severity medium
Open redirect: business.google.com website_shared URL Param severity medium
Open redirect: chkc.com.hk severity medium
Open redirect: City of Calgary severity medium
Open redirect: Club-OS severity medium
Open redirect: convertcart.com severity medium
Open redirect: Dell severity medium
Open redirect: designsori.com severity medium
Open redirect: Diesel.az severity medium
Open redirect: documentmailbox.com severity medium
Open redirect: eaoko.org severity medium
Open redirect: easycamp.com severity medium
Open redirect: embluemail.com severity medium
Open redirect: emlakarsa severity medium
Open redirect: emp.eduyield.com severity medium
Open redirect: eodcnetworkdirect.com severity medium
Open redirect: events.csiro.au severity medium
Open redirect: ExacTag severity medium
Open redirect: fenc.com severity medium
Open redirect: g7.fr severity medium
Open redirect: giving.lluh.org severity medium
Open Redirect: Google domain with /url path and suspicious indicators severity medium
Open redirect: ijf.org severity medium
Open redirect: Indeed severity medium
Open redirect: IndiaTimes severity medium
Open redirect: isadatalab.com severity medium
Open redirect: k-mil.net severity medium
Open redirect: labcluster.com severity medium
Open redirect: LearningApps severity medium
Open redirect: LinkedIn Redirect severity medium
Open redirect: listing.ca severity medium
Open redirect: magic4media.com severity medium
Open redirect: magiccity.ne.jp severity medium
Open redirect: magneticmarketing.com severity medium
Open redirect: mail.spiceworks.com severity medium
Open redirect: marketing.edinburghairport.com severity medium
Open redirect: Medium severity medium
Open redirect: mindmixer.com severity medium
Open redirect: museepicassoparis.fr severity medium
Open redirect: Newegg severity medium
Open redirect: next2.io severity medium
Open redirect: nowlifestyle.com severity medium
Open redirect: obunsha.co.jp severity medium
Open redirect: people.anuneo.com severity medium
Open redirect: phoenixartstudio.net severity medium
Open redirect: PIRL San Diego severity medium
Open redirect: plasticsurgery.or.kr severity medium
Open redirect: pmifunds.com severity medium
Open redirect: predictiveresponse.net severity medium
Open redirect: PremierBet severity medium
Open redirect: qrxtech.com severity medium
Open redirect: queue.swytchbike.com severity medium
Open redirect: radiopublic.com severity medium
Open redirect: retailrocket.net severity medium
Open redirect: ringaraja.net severity medium
Open redirect: sciencebuddies.org severity medium
Open redirect: secondstreetapp.com severity medium
Open redirect: shoppermeet.net severity medium
Open redirect: shoppingwebapi.didatravel.com severity medium
Open redirect: Signature Travel Network severity medium
Open redirect: slubnaglowie.pl severity medium
Open redirect: smartadserver.com severity medium
Open redirect: smore.com severity medium
Open redirect: social.bigpress.net severity medium
Open redirect: ssg-financial.com severity medium
Open redirect: stats.lib.pdx.edu severity medium
Open redirect: storematch.jp severity medium
Open redirect: Ticketmaster severity low
Open redirect: TikTok severity medium
Open redirect: tkqlhce.com severity medium
Open redirect: tuttocauzioni.it severity medium
Open redirect: typedrawers.com severity medium
Open redirect: unitedwaynwvt.org severity medium
Open redirect: ust.hk severity medium
Open redirect: vconfex.com severity medium
Open redirect: weblinkconnect.com severity medium
Open redirect: whitefox.pl severity medium
Open redirect: Xfinity CMP Redirection to Google AMP severity medium
Open redirect: xfinity.com severity medium
Open redirect: YouTube severity medium
Potential prompt injection attack in body HTML severity high
QR code to auto-download of a suspicious file type (unsolicited) severity high
QR Code with suspicious indicators severity high
Reconnaissance: All recipients cc/bcc'd or undisclosed severity low
Reconnaissance: Large unknown recipient list severity low
Reconnaissance: Short generic greeting message severity medium
Request for Quote or Purchase (RFQ|RFP) with suspicious sender or recipient pattern severity medium
Salesforce infrastructure abuse severity medium
Scam soliciting employer review/rating severity low
Scam: Piano giveaway severity medium
Sender name contains Active Directory distinguished name severity medium
Service abuse: Adobe Creative Cloud share from an unsolicited sender address severity low
Service abuse: Adobe Sign notification from an unsolicited reply-to address severity medium
Service abuse: Behance document sharing with suspicious language severity medium
Service abuse: DocSend share from newly registered domain severity high
Service abuse: DocuSign notification with suspicious sender or document name severity medium
Service abuse: DocuSign share from an unsolicited reply-to address severity medium
Service abuse: Dropbox share from an unsolicited reply-to address severity medium
Service abuse: Dropbox share from new domain severity medium
Service abuse: Dropbox share with suspicious sender or document name severity medium
Service abuse: Evernote link severity low
Service Abuse: GoDaddy infrastructure severity medium
Service abuse: Google application integration redirecting to suspicious hosts severity medium
Service abuse: HelloSign from an unsolicited sender address severity low
Service Abuse: HelloSign share with suspicious sender or document name severity medium
Service abuse: Meetup.com redirect with brand impersonation severity medium
Service abuse: Monday.com infrastructure with phishing intent severity high
Service abuse: QuickBooks notification from new domain severity medium
Service abuse: SendGrid impersonation via Sendgrid from new sender severity high
Service abuse: SurveyMonkey survey from newly registered domain severity high
Service abuse: Task management message sent via SendGrid severity medium
Sharepoint link likely unrelated to sender severity medium
Spam/fraud: Predatory journal/research paper request severity medium
Spam: Cryptocurrency airdrop/giveaway severity low
Spam: Default Microsoft Exchange Online sender domain (onmicrosoft.com) severity low
Spam: Fake photo share severity low
Spam: Firebase password reset from suspicious sender severity low
Spam: Ghostwriting services scam with manipulative language severity medium
Spam: Item giveaway spam template severity low
Spam: Mastercard promotional content with image-based body severity low
Spam: Single recipient duplicated in cc severity medium
Spam: Spoofed Outlook mailer with unsubscribe and reference ID footer severity low
Spam: Unsolicited WordPress account creation or password reset request severity low
Spamhaus: Mail transiting a DROP listed network severity medium
Spamhaus: Mail transiting an ASN-DROP listed network severity medium
Stripe invoice abuse severity medium
Suspicious attachment with unscannable Cloudflare link severity medium
Suspicious DocuSign share from new domain severity high
Suspicious invoice reference with missing or image-only attachments severity high
Suspicious link to Looker Studio (lookerstudio.google.com) from a new and unsolicited sender severity medium
Suspicious Links to Cloudflare R2 and Edge Services severity medium
Suspicious message with unscannable Cloudflare link severity medium
Suspicious message with unscannable Vercel link severity medium
Suspicious newly registered reply-to domain with engaging financial or urgent language severity medium
Suspicious recipients pattern with no Compauth pass and suspicious content severity medium
Suspicious request for financial information severity high
Suspicious sender display name with long procedurally generated text blob severity medium
Suspicious subject with long procedurally generated text blob severity medium
Truth Social infrastructure abuse via link redirect severity medium
Twitter infrastructure abuse via link shortener severity medium
Unusually long local part from untrusted sender address severity low
Vendor compromise: GovDelivery message with suspicious link severity high
VIP / Executive impersonation (strict match, untrusted) severity high
VIP / Executive impersonation in subject (untrusted) severity medium
VIP Impersonation via Google Group relay with suspicious indicators severity high
VIP impersonation with BEC language (near match, untrusted sender) severity medium
VIP impersonation with invoicing request severity high
VIP impersonation with urgent request (strict match, untrusted sender) severity high
VIP impersonation with w2 request with reply-to mismatch severity high
VIP impersonation: Fake thread with VIPs missing email metadata severity high
VIP impersonation: Payment handoff with VIP display name authored fake threads severity high
VIP Impersonation: VIP handoff with fake forwarded invoice thread severity high
VIP local_part impersonation from unsolicited sender severity high
X (Twitter) impersonation with credential phishing motives severity medium
Zoom Events newsletter abuse severity medium

headers.domains (collection)

52 detection rules reference this catalog entry. View catalog entry.

Sublime MQL (52)

Attachment: EML with Sharepoint link likely unrelated to sender severity medium
Attachment: Fake secure message and suspicious indicators severity medium
Brand impersonation: Adobe with suspicious language and link severity high
Brand impersonation: AliExpress severity medium
Brand impersonation: Aquent severity medium
Brand impersonation: Box file sharing service severity medium
Brand impersonation: DocuSign severity high
Brand impersonation: Mailgun severity medium
Brand impersonation: Microsoft with embedded logo and credential theft language severity high
Brand impersonation: Microsoft with low reputation links severity medium
Brand impersonation: Morgan Stanley severity medium
Brand impersonation: Okta severity medium
Brand impersonation: QuickBooks severity medium
Brand impersonation: Wix severity medium
Callback phishing in body or attachment (untrusted sender) severity medium
ClickFunnels link infrastructure abuse severity high
Compensation review with QR code in attached EML severity high
Credential phishing: 'Secure message' and engaging language severity medium
Credential phishing: Email delivery failure impersonation severity high
Credential phishing: Fake storage alerts (unsolicited) severity medium
EML attachment with credential theft language (unknown sender) severity high
Fake email quarantine notification severity high
Fake message thread with a suspicious link and engaging language from an unknown sender severity medium
Fake thread with suspicious indicators severity medium
Fake voicemail notification (untrusted sender) severity medium
Impersonation: Internal corporate services severity high
Link: Credential phishing traversing Russian infrastructure severity high
Link: Referrer anonymization service from untrusted sender severity medium
Link: Squarespace infrastructure abuse severity medium
Open redirect: bubblelife.com severity medium
Open redirect: convertcart.com severity medium
Open redirect: magic4media.com severity medium
Open redirect: pmifunds.com severity medium
Open redirect: predictiveresponse.net severity medium
Open redirect: qrxtech.com severity medium
Open redirect: secondstreetapp.com severity medium
Open redirect: Signature Travel Network severity medium
Open redirect: smartadserver.com severity medium
Open redirect: tuttocauzioni.it severity medium
Open redirect: weblinkconnect.com severity medium
Service Abuse: ExactTarget with suspicious sender indicators severity high
Service abuse: Free provider with SendGrid routing severity medium
Service abuse: Kagoya.net-hosted domains sending English business lures severity low
Service abuse: Monday.com infrastructure with phishing intent severity high
Service abuse: Sendgrid credential theft with personalized request targeting single recipient severity medium
Service abuse: SendGrid impersonation via Sendgrid from new sender severity high
Spam/fraud: Predatory journal/research paper request severity medium
Spam: BlackBaud infrastructure abuse severity medium
Spam: Personalized subject and greetings via Salesforce Marketing Cloud severity low
Spam: Sendersrv.com with financial communications and unsubscribe language severity medium
Spoofable internal domain with suspicious signals severity medium
Vendor compromise: GovDelivery message with suspicious link severity high

headers.hops (collection)

91 detection rules reference this catalog entry. View catalog entry.

Sublime MQL (91)

AnonymousFox indicators severity high
Attachment: Adobe image lure in body or attachment with suspicious link severity medium
Attachment: Calendar invite with suspicious link leading to an open redirect severity high
Attachment: DocuSign impersonation via PDF linking to new domain severity medium
Attachment: EML file contains HTML attachment with login portal indicators severity high
Attachment: Fake secure message and suspicious indicators severity medium
Attachment: Microsoft 365 credential phishing severity high
Attachment: Microsoft impersonation via PDF with link and suspicious language severity high
Attachment: RFC822 containing suspicious file sharing language with links from untrusted sender severity medium
Attachment: Romance scam with image lure and advance-fee or suspicious link indicators severity medium
BEC with unusual reply-to or return-path mismatch severity high
Benefits enrollment impersonation severity high
Brand impersonation: Adobe (QR code) severity high
Brand impersonation: Adobe Sign with suspicious indicators severity high
Brand impersonation: Amazon severity low
Brand impersonation: Booking.com severity medium
Brand impersonation: Capital One severity high
Brand impersonation: Cloud services with credential theft intent severity medium
Brand impersonation: DocuSign severity high
Brand impersonation: DocuSign branded attachment lure with no DocuSign links severity high
Brand impersonation: Dropbox severity medium
Brand impersonation: Fake DocuSign HTML table not linking to DocuSign domains severity medium
Brand impersonation: Github severity high
Brand Impersonation: Google (QR Code) severity high
Brand impersonation: Google Workspace alert notification severity medium
Brand impersonation: Internal Revenue Service severity high
Brand impersonation: Mailgun severity medium
Brand impersonation: Microsoft (QR code) severity high
Brand impersonation: Microsoft fake sign-in alert severity medium
Brand impersonation: Microsoft logo in HTML with fake quarantine release notification severity high
Brand impersonation: Microsoft with embedded logo and credential theft language severity high
Brand impersonation: Morgan Stanley severity medium
Brand Impersonation: ShareFile severity medium
Brand impersonation: Sharepoint severity high
Brand impersonation: SharePoint PDF attachment with credential theft language severity medium
Brand Impersonation: Stripe severity high
Brand impersonation: TikTok severity medium
ClickFunnels link infrastructure abuse severity high
Constant Contact link infrastructure abuse severity high
Credential phishing content and link (untrusted sender) severity high
Credential phishing language and suspicious indicators (unknown sender) severity medium
Credential phishing: 'Secure message' and engaging language severity medium
Credential phishing: DocuSign embedded image lure with no DocuSign domains in links severity high
Credential phishing: Fake password expiration from new and unsolicited sender severity medium
Credential phishing: Hyper-linked image leading to free file host severity medium
Credential phishing: Onedrive impersonation severity high
Credential phishing: Suspicious e-sign agreement document notification severity medium
Employee impersonation: Payroll fraud severity high
Encrypted Microsoft Office files from untrusted sender severity medium
Extortion / sextortion (untrusted sender) severity low
Extortion / sextortion in attachment from untrusted sender severity low
Fake message thread - Untrusted sender with a mismatched freemail reply-to address severity medium
Fake thread with suspicious indicators severity medium
Fake voicemail notification (untrusted sender) severity medium
Free email provider sender with mismatched provider reply-to severity medium
Headers: Self-sender using Microsoft CompAuth bypass with credential theft content severity high
Headers: X-Source-Auth mismatch with mismatched reply-to domain severity high
HTML smuggling containing recipient email address severity medium
Impersonation: Human Resources with link or attachment and engaging language severity medium
Impersonation: Internal corporate services severity high
Inbound message from popular service via newly observed distribution list severity medium
Link: Credential phishing traversing Russian infrastructure severity high
Link: File sharing impersonation with suspicious language and sending patterns severity medium
Link: Free file hosting with undisclosed recipients severity medium
Link: Free subdomain host with undisclosed recipients severity medium
Link: Google Calendar invite linking to an open redirect from an untrusted freemail sender severity high
Link: Uncommon SharePoint document type with sender's display name severity medium
Mass campaign: Cross Site Scripting (XSS) attempt severity medium
Message traversed multiple onmicrosoft.com tenants severity medium
Microsoft infrastructure abuse with suspicious patterns severity high
Open redirect: predictiveresponse.net severity medium
Salesforce infrastructure abuse severity medium
Service abuse: HelloSign from an unsolicited sender address severity low
Service Abuse: HelloSign share with suspicious sender or document name severity medium
Service abuse: Monday.com infrastructure with phishing intent severity high
Service abuse: Soundestlink redirect with suspicious indicators severity medium
Service abuse: Trello board invitation with VIP impersonation severity medium
SharePoint OTP for filename matching org name severity medium
Spam/fraud: Predatory journal/research paper request severity medium
Spam: BlackBaud infrastructure abuse severity medium
Spam: Default Microsoft Exchange Online sender domain (onmicrosoft.com) severity low
Spam: Fake photo share severity low
Spam: Personalized subject and greetings via Salesforce Marketing Cloud severity low
Spam: Single recipient duplicated in cc severity medium
SPF temp error severity medium
Spoofable internal domain with suspicious signals severity medium
Suspected cross-site scripting (XSS) found in subject severity medium
Suspicious mailer received from Gmail servers severity low
Suspicious recipients pattern with no Compauth pass and suspicious content severity medium
VIP Impersonation via Google Group relay with suspicious indicators severity high
Xero infrastructure abuse severity medium

headers.ips (collection)

4 detection rules reference this catalog entry. View catalog entry.

Sublime MQL (4)

Observed IOC: Mail transiting bulletproof host - SmartApe severity medium
Observed IOC: Mail transiting OFAC-sanctioned bulletproof host Aeza Group severity high
Spamhaus: Mail transiting a DROP listed network severity medium
Spamhaus: Mail transiting an ASN-DROP listed network severity medium

headers.reply_to (collection)

82 detection rules reference this catalog entry. View catalog entry.

Sublime MQL (82)

Advance Fee Fraud (AFF) from freemail provider or suspicious TLD severity medium
Attachment: EML with link to credential phishing page severity high
Attachment: Invoice and W-9 PDFs with suspicious creators severity high
Attachment: Office document with VSTO add-in severity high
Attachment: PDF with credential theft language and invalid reply-to domain severity medium
Attachment: Romance scam with image lure and advance-fee or suspicious link indicators severity medium
BEC with unusual reply-to or return-path mismatch severity high
BEC/Fraud: Generic scam attempt to undisclosed recipients severity low
BEC/Fraud: Penpal scam severity medium
BEC/Fraud: Self-addressed reply with unrelated link in ongoing thread severity medium
BEC/Fraud: Urgent language and suspicious sending/infrastructure patterns severity medium
BEC: Tax document request severity medium
Brand impersonation: Aramco severity medium
Brand impersonation: Google Workspace alert notification severity medium
Brand impersonation: LinkedIn severity medium
Brand impersonation: Meta and subsidiaries severity medium
Brand impersonation: Microsoft fake sign-in alert severity medium
Brand impersonation: Norton severity low
Brand impersonation: QuickBooks notification from Intuit themed company name severity medium
Business Email Compromise (BEC) attempt from unsolicited sender severity medium
Business Email Compromise (BEC) attempt with masked recipients and reply-to mismatch (unsolicited) severity medium
Callback phishing via e-signature service severity high
Callback phishing: Branded invoice from sender/reply-to domain less than 30 days old severity medium
COVID-19 themed fraud with sender and reply-to mismatch or compensation award severity medium
Cyrillic vowel substitution in subject or display name from unknown sender severity medium
Cyrillic vowel substitutions with suspicious subject from unknown sender severity medium
Domain impersonation: Freemail reply-to local lookalike with financial request severity medium
Employee impersonation: Payroll fraud severity high
Fake message thread - Untrusted sender with a mismatched freemail reply-to address severity medium
Fake request for tax preparation severity high
Fraudulent order confirmation/shipping notification from Chinese sender domain severity medium
Free email provider sender with mismatched provider reply-to severity medium
Generic service abuse from newly registered domain severity high
Google share notification with suspicious comments severity high
Headers: Invalid recipient domain with mismatched reply-to from new sender severity medium
Headers: X-Source-Auth mismatch with mismatched reply-to domain severity high
Honorific greeting BEC attempt with sender and reply-to mismatch severity low
HR impersonation via e-sign agreement comment severity high
Impersonation: Suspected supplier impersonation with suspicious content severity high
Inbound message from popular service via newly observed distribution list severity medium
Investor solicitation with organization targeting severity medium
Link: File sharing impersonation with suspicious language and sending patterns severity medium
Link: Invalid reply-to with recipient details in subject, body, and encoded link severity medium
Link: Multistage landing - Abused Google Drive severity high
Link: Multistage landing - Published Google Doc severity high
Link: Romance/Sexual Language With Suspicious Link severity low
Newly registered sender or reply-to domain with newly registered linked domain severity medium
Reconnaissance: Empty subject with mismatched reply-to from new sender severity medium
Reconnaissance: Hotel booking reply-to redirect severity medium
Request for Quote or Purchase (RFQ|RFP) with suspicious sender or recipient pattern severity medium
Scam: Fake estate sale offering welding equipment and tools severity high
Scam: Piano giveaway severity medium
Service abuse: AppSheet infrastructure with suspicious indicators severity medium
Service abuse: Cisco secure email service with financial request severity high
Service abuse: DocSend share from newly registered domain severity high
Service abuse: DocuSign notification with suspicious sender or document name severity medium
Service abuse: DocuSign share from an unsolicited reply-to address severity medium
Service abuse: Dropbox share from new domain severity medium
Service abuse: Dropbox share with suspicious sender or document name severity medium
Service abuse: GitHub notification with excessive mentions and suspicious links severity high
Service abuse: Google Drive share from an unsolicited reply-to address severity medium
Service abuse: Google Drive share from new reply-to domain severity medium
Service abuse: Google Firebase sender address with suspicious content severity low
Service abuse: Postman reply-to mismatch with credential theft intent severity medium
Service abuse: QuickBooks notification from new domain severity medium
Service abuse: SurveyMonkey survey from newly registered domain severity high
Service abuse: Zohodesk reply-to mismatch with job scam indicators severity medium
Service abuse: Zoom Clips with suspicious reply-to address or links severity low
Service Abuse: Zoom with freemail reply-to and recipient address in greeting severity medium
Service abuse: Zoom with newly registered reply-to domain severity medium
Spam: Sexually explicit Google Drive share severity low
Spam: Sexually explicit Looker Studio report severity low
Suspicious DocuSign share from new domain severity high
Suspicious newly registered reply-to domain with engaging financial or urgent language severity medium
Suspicious request for financial information severity high
Suspicious SharePoint file sharing severity medium
VIP / Executive impersonation (strict match, untrusted) severity high
VIP Impersonation via Google Group relay with suspicious indicators severity high
VIP impersonation with BEC language (near match, untrusted sender) severity medium
VIP impersonation with invoicing request severity high
VIP impersonation with urgent request (strict match, untrusted sender) severity high
VIP impersonation with w2 request with reply-to mismatch severity high

headers.return_path

38 detection rules reference this catalog entry. View catalog entry.

Sublime MQL (38)

BEC with unusual reply-to or return-path mismatch severity high
Brand impersonation: Google Drive fake file share severity medium
Brand impersonation: Greenvelope severity medium
Brand impersonation: Ledger severity low
Brand impersonation: LinkedIn severity medium
Brand impersonation: Microsoft fake sign-in alert severity medium
Brand impersonation: Microsoft with embedded logo and credential theft language severity high
Business Email Compromise (BEC) attempt from unsolicited sender severity medium
Callback phishing: Branded invoice from sender/reply-to domain less than 30 days old severity medium
Credential phishing: Engaging language and other indicators (untrusted sender) severity medium
Cyrillic vowel substitution in subject or display name from unknown sender severity medium
Fake request for tax preparation severity high
Fake shipping notification with link to free file hosting severity low
Fake thread with suspicious indicators severity medium
Google Notification alert link from non-Google sender severity medium
Inbound message from popular service via newly observed distribution list severity medium
Invoicera infrastructure abuse severity medium
Link: File sharing impersonation with suspicious language and sending patterns severity medium
Link: Free file hosting with undisclosed recipients severity medium
Link: Self-sender with IP geolocation check and suspicious link behavior severity medium
Link: Squarespace infrastructure abuse severity medium
Message traversed multiple onmicrosoft.com tenants severity medium
Microsoft infrastructure abuse with suspicious patterns severity high
Open redirect: bestdeals.today severity medium
Open redirect: isadatalab.com severity medium
Open redirect: queue.swytchbike.com severity medium
Open redirect: Ticketmaster severity low
Russia return-path TLD (untrusted sender) severity low
Salesforce infrastructure abuse severity medium
Sendgrid onmicrosoft.com domain phishing severity medium
Sendgrid voicemail phish severity high
Service abuse: AWS SNS callback scam impersonation severity medium
Service abuse: GitHub notification with excessive mentions and suspicious links severity high
Service abuse: Outlook Groups with Google Sites link and evasion tag severity medium
Service abuse: Task management message sent via SendGrid severity medium
Suspicious mailer received from Gmail servers severity low
Tax Form: W-8BEN solicitation severity medium
VIP Impersonation via Google Group relay with suspicious indicators severity high

headers.x_authenticated_domain

1 detection rules reference this catalog entry. View catalog entry.

Sublime MQL (1)

VIP impersonation with invoicing request severity high

headers.x_authenticated_sender

1 detection rules reference this catalog entry. View catalog entry.

Sublime MQL (1)

VIP impersonation with invoicing request severity high

headers.x_originating_ip

1 detection rules reference this catalog entry. View catalog entry.

Sublime MQL (1)

BEC/Fraud: Urgent language and suspicious sending/infrastructure patterns severity medium

Back to all Sublime-Message-headers catalog entries