Detection rules › By catalog entry

Sublime-Message-mailbox

Catalog entry	Rules
mailbox	9
mailbox.email	4

mailbox

9 detection rules reference this catalog entry. View catalog entry.

Sublime MQL (9)

Credential phishing: Generic document share with unicode and proceedural greeting template severity low
Credential phishing: Suspicious e-sign agreement document notification severity medium
Employee impersonation: Payroll fraud severity high
Impersonation: Employee name in subject with suspicious sender severity medium
Reconnaissance: Short generic greeting message severity medium
Spam/fraud: Predatory journal/research paper request severity medium
VIP / Executive impersonation (strict match, untrusted) severity high
VIP / Executive impersonation in subject (untrusted) severity medium
VIP local_part impersonation from unsolicited sender severity high

mailbox.email

4 detection rules reference this catalog entry. View catalog entry.

Sublime MQL (4)

Display name and subject impersonation using recipient SLD (new sender) severity medium
Display name impersonation using recipient SLD severity medium
Inbound message from popular service via newly observed distribution list severity medium
Link: Free file hosting with undisclosed recipients severity medium

Back to all Sublime-Message-mailbox catalog entries