Detection rules › By event

Sublime-Message-mailbox

Event	Rules
mailbox	9
mailbox.email	4

mailbox

9 detection rules reference this event. View event page.

Sublime MQL (9)

Credential phishing: Generic document share with unicode and proceedural greeting template severity low
Credential phishing: Suspicious e-sign agreement document notification severity medium
Employee impersonation: Payroll fraud severity high
Impersonation: Employee name in subject with suspicious sender severity medium
Reconnaissance: Short generic greeting message severity medium
Spam/fraud: Predatory journal/research paper request severity medium
VIP / Executive impersonation (strict match, untrusted) severity high
VIP / Executive impersonation in subject (untrusted) severity medium
VIP local_part impersonation from unsolicited sender severity high

mailbox.email

4 detection rules reference this event. View event page.

Sublime MQL (4)

Display name and subject impersonation using recipient SLD (new sender) severity medium
Display name impersonation using recipient SLD severity medium
Inbound message from popular service via newly observed distribution list severity medium
Link: Free file hosting with undisclosed recipients severity medium