Detection rules › By catalog entry

Sublime-Message-recipients

Catalog entry	Rules
recipients	189
recipients.bcc (collection)	2
recipients.cc (collection)	17
recipients.to (collection)	188

recipients

189 detection rules reference this catalog entry. View catalog entry.

Sublime MQL (189)

Abuse: Cloudflare Workers Hosted EvilTokens Domain Structure severity high
Advance Fee Fraud (AFF) from freemail provider or suspicious TLD severity medium
Attachment: Adobe image lure in body or attachment with suspicious link severity medium
Attachment: Callback phishing solicitation via image file severity high
Attachment: Callback phishing solicitation via pdf file severity high
Attachment: Compensation review lure with QR code severity high
Attachment: Compensation-themed DOCX with QR code credential theft severity high
Attachment: EML with link to credential phishing page severity high
Attachment: EML with QR code redirecting to Cloudflare challenges severity low
Attachment: EML with suspicious indicators severity medium
Attachment: Encrypted PDF with credential theft body severity medium
Attachment: Encrypted PDF with credential theft language in EML severity medium
Attachment: HTML file with reference to recipient and suspicious patterns severity high
Attachment: HTML smuggling with excessive string concatenation and suspicious patterns severity medium
Attachment: HTML with obfuscation and recipient's email in JavaScript strings severity high
Attachment: PDF with credential theft language and invalid reply-to domain severity medium
Attachment: PDF with localhost IP in EXIF title metadata severity medium
Attachment: PDF with QR code containing recipient-specific credential theft content severity high
Attachment: PDF with recipient email in link severity high
Attachment: PDF with self-service platform links with self sender or blank recipients severity medium
Attachment: QR code link with base64-encoded recipient address severity high
Attachment: QR code with credential phishing indicators severity medium
Attachment: QR code with encoded recipient targeting and redirect indicators severity high
Attachment: QR code with recipient targeting and special characters severity high
Attachment: QR code with suspicious URL patterns in EML file severity high
Attachment: QR code with userinfo portion severity high
Attachment: RTF file with suspicious link severity medium
Attachment: Self-sender PDF with minimal content and view prompt severity high
Attachment: Small text file with link containing recipient email address severity medium
Attachment: Suspicious employee policy update document lure severity medium
Attachment: SVG files with evasion elements severity high
Attachment: Targeted DOCX with personalized recipient acknowledgement lure severity medium
BEC/Fraud: Generic scam attempt to undisclosed recipients severity low
BEC/Fraud: Job scam fake thread or plaintext pivot to freemail severity medium
BEC/Fraud: Reply-chain manipulation with urgent keywords and self-reply severity medium
BEC/Fraud: Scam lure with freemail pivot severity low
BEC/Fraud: Self-addressed reply with unrelated link in ongoing thread severity medium
BEC/Fraud: Urgent language and suspicious sending/infrastructure patterns severity medium
Body HTML: Recipient SLD in HTML class severity medium
Body: Fake secure email portal with HTML obfuscation severity high
Body: HTML whitespace stuffing with short initial message severity medium
Brand impersonation: Adobe (QR code) severity high
Brand impersonation: Adobe Sign with suspicious indicators severity high
Brand impersonation: Bank of America severity high
Brand impersonation: Bids & Tenders severity high
Brand impersonation: Deloitte LLC domain in CC severity high
Brand impersonation: File sharing notification with template artifacts severity low
Brand impersonation: Google Drive fake file share severity medium
Brand impersonation: Hulu severity medium
Brand impersonation: LastPass severity high
Brand impersonation: Mailgun severity medium
Brand impersonation: Meta and subsidiaries severity medium
Brand impersonation: Microsoft (QR code) severity high
Brand impersonation: Microsoft Planner with suspicious link severity medium
Brand impersonation: Microsoft with low reputation links severity medium
Brand impersonation: Netflix severity low
Brand impersonation: Norton severity low
Brand impersonation: Sharepoint fake file share severity medium
Brand impersonation: Zoom via lookalike domain severity high
Business Email Compromise (BEC) attempt with masked recipients and reply-to mismatch (unsolicited) severity medium
Callback phishing solicitation in message body severity medium
Callback phishing: AOL senders with suspicious HTML template or PDF attachment severity high
Callback Scam: Outlook groups severity medium
Commonly abused sender TLD with engaging language severity medium
Credential phishing content and link (untrusted sender) severity high
Credential phishing language and suspicious indicators (unknown sender) severity medium
Credential phishing: 'Secure message' and engaging language severity medium
Credential phishing: Email delivery failure impersonation severity high
Credential phishing: Engaging language and other indicators (untrusted sender) severity medium
Credential phishing: Fake password expiration from new and unsolicited sender severity medium
Credential phishing: Generic document share with unicode and proceedural greeting template severity low
Credential phishing: Generic document sharing severity medium
Credential phishing: Personalized document signing request severity medium
Credential phishing: Re-Authentication lure severity high
Credential phishing: Suspicious e-sign agreement document notification severity medium
Credential Phishing: Suspicious language, link, recipients and other indicators severity medium
Deceptive Dropbox mention severity medium
Display name and subject impersonation using recipient SLD (new sender) severity medium
Display name impersonation using recipient SLD severity medium
EML attachment with credential theft language (unknown sender) severity high
Employee impersonation: Payroll fraud severity high
Fake email quarantine notification severity high
Fake shipping notification with suspicious language severity medium
Fake thread with suspicious indicators severity medium
Fake voicemail notification (untrusted sender) severity medium
Fake Zoho Sign template abuse severity medium
Fake Zoom meeting invite with suspicious link severity medium
Fraudulent order confirmation/shipping notification from Chinese sender domain severity medium
Free subdomain link with credential theft indicators severity high
Google Accelerated Mobile Pages (AMP) abuse severity medium
Headers: Invalid recipient domain with mismatched reply-to from new sender severity medium
Headers: Self-sender using Microsoft CompAuth bypass with credential theft content severity high
HTML smuggling containing recipient email address severity medium
HTML: Template placeholders or recipient email in element class attributes severity high
Impersonation using recipient domain (untrusted sender) severity medium
Impersonation: Legal firm with copyright infringement notice severity medium
Impersonation: Recipient organization in sender display name with credential theft image severity medium
Impersonation: SharePoint reply header anomaly severity medium
Inbound message from popular service via newly observed distribution list severity medium
Investor solicitation with organization targeting severity medium
Invoicera infrastructure abuse severity medium
Job scam (unsolicited sender) severity low
Link abuse: Self-service creation platform link with suspicious recipient behavior severity high
Link: Commonly Abused Web Service redirecting to ZIP file severity medium
Link: Credential phishing link with undisclosed recipients severity medium
Link: Credential theft with invisible Unicode character in page title from unsolicited sender severity high
Link: Display text matches subject line severity medium
Link: File sharing impersonation with suspicious language and sending patterns severity medium
Link: Financial account issue with suspicious indicators severity medium
Link: Free file hosting with undisclosed recipients severity medium
Link: Free subdomain host with undisclosed recipients severity medium
Link: Generic financial document with proceedural timeline template severity medium
Link: Gmail phishkit with suspicious recipient severity high
Link: IPFS severity medium
Link: JavaScript obfuscation with Telegram bot integration severity high
Link: Mamba 2FA phishing kit severity high
Link: Microsoft device code authentication with suspicious indicators severity high
Link: Microsoft protected message with suspicious recipient patterns severity medium
Link: PDF filename impersonation with credential theft language severity medium
Link: Personal SharePoint with invalid recipients and credential theft language severity medium
Link: Personalized URL with recipient address on commonly abused web service severity medium
Link: QR Code with suspicious language (untrusted sender) severity medium
Link: Recipient domain in URL path severity high
Link: Recipient email address in 'eta' parameter severity high
Link: Self-sender credential theft with configuration placeholder severity high
Link: Self-sender with IP geolocation check and suspicious link behavior severity medium
Link: Self-sender with sender org in subject and credential theft indicator severity high
Link: Self-sent message with quarterly document review request severity critical
Link: Self-sent PDF lure with subject correlation severity medium
Link: SharePoint OneNote or PDF link with self sender behavior severity medium
Link: Single character path with credential theft body and self sender behavior or invalid recipient severity medium
Link: Spam website with evasion indicators severity low
Link: Suspicious recipient with timeout redirect severity medium
Link: Suspicious URL with recipient targeting and special characters severity high
Link: SVG with embedded recipient data severity high
Link: Tax document lure Portuguese/Spanish with suspicious domains severity medium
Link: Tycoon2FA phishing kit (non-exhaustive) severity high
Link: Unsolicited email contains link leading to Tycoon URL structure severity high
Link: URL redirecting to blob URL severity medium
Link: URL shortener with copy-paste instructions and credential theft language severity low
Mass campaign: Cross Site Scripting (XSS) attempt severity medium
Mass campaign: recipient address in subject, body, and link (untrusted sender) severity medium
Message traversed multiple onmicrosoft.com tenants severity medium
Microsoft infrastructure abuse with suspicious patterns severity high
Open redirect: Recipient address embedded in redirect URL pointing to newly registered domain severity medium
QR Code with suspicious indicators severity high
Reconnaissance: All recipients cc/bcc'd or undisclosed severity low
Reconnaissance: Hotel booking reply-to redirect severity medium
Reconnaissance: Large unknown recipient list severity low
Reconnaissance: Short generic greeting message severity medium
Request for Quote or Purchase (RFQ|RFP) with suspicious sender or recipient pattern severity medium
Salesforce infrastructure abuse severity medium
Scam: Fake estate sale offering welding equipment and tools severity high
Scam: Piano giveaway severity medium
Self-impersonation: Sender matches recipient with bolded name and suspicious link severity medium
Self-sender with copy/paste instructions and suspicious domains (French/Français) severity medium
Self-sent fake PDF attachment with misleading link severity low
Service abuse: Cisco secure email service with financial request severity high
Service abuse: Coursera callback scam severity high
Service abuse: GitHub notification with excessive mentions and suspicious links severity high
Service abuse: Microsoft Forms Pro with suspicious links or QR codes severity medium
Service Abuse: Nifty.com with impersonation severity medium
Service abuse: Sendgrid credential theft with personalized request targeting single recipient severity medium
Sharepoint file share with suspicious recipients pattern severity medium
Sharepoint online with external recipients and external display name severity medium
Spam/fraud: Predatory journal/research paper request severity medium
Spam: Default Microsoft Exchange Online sender domain (onmicrosoft.com) severity low
Spam: Fake dating profile notification severity low
Spam: Link to blob.core.windows.net from new domain (<30d) severity medium
Spam: New job cold outreach from unsolicited sender severity low
Spam: Single recipient duplicated in cc severity medium
Spam: Unsolicited malformed PDF severity low
Spam: Unsolicited WordPress account creation or password reset request severity low
Suspicious recipient pattern and language with low reputation link to login severity medium
Suspicious recipients pattern with NLU credential theft indicators severity medium
Suspicious recipients pattern with no Compauth pass and suspicious content severity medium
Suspicious request for financial information severity high
Suspicious subject with long procedurally generated text blob severity medium
Targeting: Specific AOL address severity medium
VIP / Executive impersonation (strict match, untrusted) severity high
VIP / Executive impersonation in subject (untrusted) severity medium
VIP impersonation: Fabricated thread history with fake VIP recipients severity high
VIP impersonation: Fake thread with VIPs missing email metadata severity high
VIP impersonation: Invoice fraud with mobile device sign-off severity high
VIP impersonation: Payment handoff with VIP display name authored fake threads severity high
VIP Impersonation: VIP handoff with fake forwarded invoice thread severity high
VIP impersonation: VIP payment redirect handoff via fake threads severity high
VIP local_part impersonation from unsolicited sender severity high
Xero infrastructure abuse severity medium

recipients.bcc (collection)

2 detection rules reference this catalog entry. View catalog entry.

Sublime MQL (2)

Credential phishing: Generic document share with unicode and proceedural greeting template severity low
Reconnaissance: Short generic greeting message severity medium

recipients.cc (collection)

17 detection rules reference this catalog entry. View catalog entry.

Sublime MQL (17)

Attachment: Adobe image lure in body or attachment with suspicious link severity medium
Attachment: Encrypted PDF with credential theft language in EML severity medium
Attachment: QR code with userinfo portion severity high
Brand impersonation: Deloitte LLC domain in CC severity high
Brand impersonation: Google Drive fake file share severity medium
Brand impersonation: Hulu severity medium
Brand impersonation: Netflix severity low
Job scam (unsolicited sender) severity low
Link abuse: Self-service creation platform link with suspicious recipient behavior severity high
Link: File sharing impersonation with suspicious language and sending patterns severity medium
Link: Personal SharePoint with invalid recipients and credential theft language severity medium
Reconnaissance: Short generic greeting message severity medium
Request for Quote or Purchase (RFQ|RFP) with suspicious sender or recipient pattern severity medium
Service abuse: GitHub notification with excessive mentions and suspicious links severity high
Spam: Single recipient duplicated in cc severity medium
Suspicious recipient pattern and language with low reputation link to login severity medium
VIP impersonation: Fabricated thread history with fake VIP recipients severity high

recipients.to (collection)

188 detection rules reference this catalog entry. View catalog entry.

Sublime MQL (188)

Abuse: Cloudflare Workers Hosted EvilTokens Domain Structure severity high
Attachment: Adobe image lure in body or attachment with suspicious link severity medium
Attachment: Callback phishing solicitation via image file severity high
Attachment: Callback phishing solicitation via pdf file severity high
Attachment: Compensation review lure with QR code severity high
Attachment: Compensation-themed DOCX with QR code credential theft severity high
Attachment: DOCX with hyperlink targeting recipient address severity medium
Attachment: EML with link to credential phishing page severity high
Attachment: EML with QR code redirecting to Cloudflare challenges severity low
Attachment: EML with suspicious indicators severity medium
Attachment: Encrypted PDF with credential theft body severity medium
Attachment: Encrypted PDF with credential theft language in EML severity medium
Attachment: HTML file with reference to recipient and suspicious patterns severity high
Attachment: HTML smuggling with excessive string concatenation and suspicious patterns severity medium
Attachment: HTML with obfuscation and recipient's email in JavaScript strings severity high
Attachment: ICS calendar file with base64 encoded recipient address in URL parameters severity high
Attachment: ICS calendar file with QR code containing recipient email address severity high
Attachment: ICS calendar file with recipient address in UID field severity high
Attachment: PDF credential phishing via wkhtmltopdf/Qt with suspicious link severity high
Attachment: PDF file with recipient domain and ATT eCheckRun pattern severity medium
Attachment: PDF with credential theft language and invalid reply-to domain severity medium
Attachment: PDF with localhost IP in EXIF title metadata severity medium
Attachment: PDF with QR code containing recipient-specific credential theft content severity high
Attachment: PDF with recipient email in link severity high
Attachment: PDF with self-service platform links with self sender or blank recipients severity medium
Attachment: QR code link with base64-encoded recipient address severity high
Attachment: QR code with credential phishing indicators severity medium
Attachment: QR code with encoded recipient targeting and redirect indicators severity high
Attachment: QR code with recipient targeting and special characters severity high
Attachment: QR code with suspicious URL patterns in EML file severity high
Attachment: QR code with userinfo portion severity high
Attachment: RTF file with suspicious link severity medium
Attachment: Self-sender PDF with minimal content and view prompt severity high
Attachment: Small text file with link containing recipient email address severity medium
Attachment: Suspicious employee policy update document lure severity medium
Attachment: SVG files with evasion elements severity high
Attachment: Targeted DOCX with personalized recipient acknowledgement lure severity medium
BEC/Fraud: Job scam fake thread or plaintext pivot to freemail severity medium
BEC/Fraud: Reply-chain manipulation with urgent keywords and self-reply severity medium
BEC/Fraud: Scam lure with freemail pivot severity low
BEC/Fraud: Self-addressed reply with unrelated link in ongoing thread severity medium
BEC/Fraud: Urgent language and suspicious sending/infrastructure patterns severity medium
Body HTML: Recipient SLD in HTML class severity medium
Body: Fake secure email portal with HTML obfuscation severity high
Body: HTML whitespace stuffing with short initial message severity medium
Brand impersonation: Adobe (QR code) severity high
Brand impersonation: Adobe Sign with suspicious indicators severity high
Brand impersonation: Bank of America severity high
Brand impersonation: Bids & Tenders severity high
Brand impersonation: File sharing notification with template artifacts severity low
Brand impersonation: Google Drive fake file share severity medium
Brand impersonation: Hulu severity medium
Brand impersonation: LastPass severity high
Brand impersonation: Mailgun severity medium
Brand impersonation: Meta and subsidiaries severity medium
Brand impersonation: Microsoft (QR code) severity high
Brand impersonation: Microsoft Planner with suspicious link severity medium
Brand impersonation: Microsoft with low reputation links severity medium
Brand impersonation: Netflix severity low
Brand impersonation: Norton severity low
Brand impersonation: Sharepoint fake file share severity medium
Business Email Compromise (BEC) attempt with masked recipients and reply-to mismatch (unsolicited) severity medium
Callback phishing solicitation in message body severity medium
Callback phishing via Apple ID display name abuse severity high
Callback Scam: Outlook groups severity medium
Commonly abused sender TLD with engaging language severity medium
Credential phishing content and link (untrusted sender) severity high
Credential phishing language and suspicious indicators (unknown sender) severity medium
Credential phishing: 'Secure message' and engaging language severity medium
Credential phishing: AWS Lambda URL with recipient targeting severity medium
Credential phishing: Email delivery failure impersonation severity high
Credential phishing: Engaging language and other indicators (untrusted sender) severity medium
Credential phishing: Fake password expiration from new and unsolicited sender severity medium
Credential phishing: Generic document share with unicode and proceedural greeting template severity low
Credential phishing: Generic document sharing severity medium
Credential phishing: Personalized document signing request severity medium
Credential phishing: Re-Authentication lure severity high
Credential phishing: Suspicious e-sign agreement document notification severity medium
Credential Phishing: Suspicious language, link, recipients and other indicators severity medium
Deceptive Dropbox mention severity medium
Display name and subject impersonation using recipient SLD (new sender) severity medium
Display name impersonation using recipient SLD severity medium
EML attachment with credential theft language (unknown sender) severity high
Fake email quarantine notification severity high
Fake shipping notification with suspicious language severity medium
Fake thread with suspicious indicators severity medium
Fake voicemail notification (untrusted sender) severity medium
Fake Zoho Sign template abuse severity medium
Fake Zoom meeting invite with suspicious link severity medium
Free subdomain link with credential theft indicators severity high
Google Accelerated Mobile Pages (AMP) abuse severity medium
Headers: Invalid recipient domain with mismatched reply-to from new sender severity medium
Headers: Self-sender using Microsoft CompAuth bypass with credential theft content severity high
HTML smuggling containing recipient email address severity medium
HTML: Template placeholders or recipient email in element class attributes severity high
Impersonation using recipient domain (untrusted sender) severity medium
Impersonation: Recipient organization in sender display name with credential theft image severity medium
Impersonation: SharePoint reply header anomaly severity medium
Inbound message from popular service via newly observed distribution list severity medium
Investor solicitation with organization targeting severity medium
Invoicera infrastructure abuse severity medium
Job scam (unsolicited sender) severity low
Link abuse: Self-service creation platform link with suspicious recipient behavior severity high
Link: Base64 encoded recipient address in URL fragment with hex subdomain severity high
Link: Base64 encoded recipient address in URL fragment with subject hash severity low
Link: Commonly Abused Web Service redirecting to ZIP file severity medium
Link: Credential phishing link with undisclosed recipients severity medium
Link: Credential theft with Cloudflare tunnel and recipient targeting severity high
Link: Credential theft with invisible Unicode character in page title from unsolicited sender severity high
Link: Display text matches subject line severity medium
Link: File sharing impersonation with suspicious language and sending patterns severity medium
Link: Free file hosting with undisclosed recipients severity medium
Link: Free subdomain host with undisclosed recipients severity medium
Link: Generic financial document with proceedural timeline template severity medium
Link: Gmail phishkit with suspicious recipient severity high
Link: Invalid reply-to with recipient details in subject, body, and encoded link severity medium
Link: IPFS severity medium
Link: JavaScript obfuscation with Telegram bot integration severity high
Link: Mamba 2FA phishing kit severity high
Link: Microsoft protected message with suspicious recipient patterns severity medium
Link: PDF filename impersonation with credential theft language severity medium
Link: Personal SharePoint with invalid recipients and credential theft language severity medium
Link: Personalized URL with recipient address on commonly abused web service severity medium
Link: QR Code with suspicious language (untrusted sender) severity medium
Link: Recipient domain in URL path severity high
Link: Recipient email address in 'eta' parameter severity high
Link: RTL text reversal with recipient email in URL severity medium
Link: Self-sender credential theft with configuration placeholder severity high
Link: Self-sender with IP geolocation check and suspicious link behavior severity medium
Link: Self-sender with sender org in subject and credential theft indicator severity high
Link: Self-sent message with quarterly document review request severity critical
Link: Self-sent PDF lure with subject correlation severity medium
Link: SharePoint OneNote or PDF link with self sender behavior severity medium
Link: Single character path with credential theft body and self sender behavior or invalid recipient severity medium
Link: Spam website with evasion indicators severity low
Link: Suspicious file retrieval with recipient targeting severity high
Link: Suspicious recipient with timeout redirect severity medium
Link: Suspicious URL with recipient targeting and special characters severity high
Link: SVG with embedded recipient data severity high
Link: Tax document lure Portuguese/Spanish with suspicious domains severity medium
Link: Tycoon2FA phishing kit (non-exhaustive) severity high
Link: Unsolicited email contains link leading to Tycoon URL structure severity high
Link: URL redirecting to blob URL severity medium
Link: URL shortener with copy-paste instructions and credential theft language severity low
Link: WordPress admin targeting with recipient identifier in URL parts severity high
Mass campaign: Cross Site Scripting (XSS) attempt severity medium
Mass campaign: recipient address in subject, body, and link (untrusted sender) severity medium
Message traversed multiple onmicrosoft.com tenants severity medium
Microsoft infrastructure abuse with suspicious patterns severity high
Open redirect: Recipient address embedded in redirect URL pointing to newly registered domain severity medium
QR Code with suspicious indicators severity high
Reconnaissance: All recipients cc/bcc'd or undisclosed severity low
Reconnaissance: Hotel booking reply-to redirect severity medium
Reconnaissance: Large unknown recipient list severity low
Reconnaissance: Short generic greeting message severity medium
Request for Quote or Purchase (RFQ|RFP) with suspicious sender or recipient pattern severity medium
Salesforce infrastructure abuse severity medium
Self-impersonation: Sender matches recipient with bolded name and suspicious link severity medium
Self-sender with copy/paste instructions and suspicious domains (French/Français) severity medium
Self-sent fake PDF attachment with misleading link severity low
Sender: Local part built from recipient domain and mailbox severity low
Service abuse: Adobe legitimate domain with document approval language severity medium
Service abuse: Adobe share containing newly observed email address domain severity high
Service abuse: Cisco secure email service with financial request severity high
Service abuse: Coursera callback scam severity high
Service abuse: Microsoft Forms Pro with suspicious links or QR codes severity medium
Service Abuse: Nifty.com with impersonation severity medium
Service abuse: Sendgrid credential theft with personalized request targeting single recipient severity medium
Service Abuse: Zoom with freemail reply-to and recipient address in greeting severity medium
Sharepoint file share with suspicious recipients pattern severity medium
Sharepoint online with external recipients and external display name severity medium
Spam/fraud: Predatory journal/research paper request severity medium
Spam: Fake dating profile notification severity low
Spam: Link to blob.core.windows.net from new domain (<30d) severity medium
Spam: Single recipient duplicated in cc severity medium
Spam: Unsolicited malformed PDF severity low
Spam: Unsolicited WordPress account creation or password reset request severity low
Suspicious recipient pattern and language with low reputation link to login severity medium
Suspicious recipients pattern with NLU credential theft indicators severity medium
Suspicious recipients pattern with no Compauth pass and suspicious content severity medium
Suspicious request for financial information severity high
Suspicious subject with long procedurally generated text blob severity medium
Targeting: Specific AOL address severity medium
VIP / Executive impersonation in subject (untrusted) severity medium
VIP impersonation: Fabricated thread history with fake VIP recipients severity high
VIP impersonation: Payment handoff with VIP display name authored fake threads severity high
VIP impersonation: VIP payment redirect handoff via fake threads severity high
Xero infrastructure abuse severity medium

Back to all Sublime-Message-recipients catalog entries