Sublime-Message-recipients Event ID 7000022

Sublime MQL (162)

• Abuse: Cloudflare Workers Hosted EvilTokens Domain Structure severity high
• Attachment: Adobe image lure in body or attachment with suspicious link severity medium
• Attachment: Callback phishing solicitation via image file severity high
• Attachment: Callback phishing solicitation via pdf file severity high
• Attachment: Compensation review lure with QR code severity high
• Attachment: Compensation-themed DOCX with QR code credential theft severity high
• Attachment: DOCX with hyperlink targeting recipient address severity medium
• Attachment: EML with link to credential phishing page severity high
• Attachment: EML with QR code redirecting to Cloudflare challenges severity low
• Attachment: EML with suspicious indicators severity medium
• Attachment: Encrypted PDF with credential theft body severity medium
• Attachment: HTML file with reference to recipient and suspicious patterns severity high
• Attachment: HTML smuggling with excessive string concatenation and suspicious patterns severity medium
• Attachment: HTML with obfuscation and recipient's email in JavaScript strings severity high
• Attachment: ICS calendar file with base64 encoded recipient address in URL parameters severity high
• Attachment: ICS calendar file with QR code containing recipient email address severity high
• Attachment: ICS calendar file with recipient address in UID field severity high
• Attachment: PDF with credential theft language and invalid reply-to domain severity medium
• Attachment: PDF with QR code containing recipient-specific credential theft content severity high
• Attachment: PDF with recipient email in link severity high
• Attachment: PDF with self-service platform links with self sender or blank recipients severity medium
• Attachment: QR code link with base64-encoded recipient address severity high
• Attachment: QR code with credential phishing indicators severity medium
• Attachment: QR code with encoded recipient targeting and redirect indicators severity high
• Attachment: QR code with recipient targeting and special characters severity high
• Attachment: QR code with suspicious URL patterns in EML file severity high
• Attachment: QR code with userinfo portion severity high
• Attachment: RTF file with suspicious link severity medium
• Attachment: Self-sender PDF with minimal content and view prompt severity high
• Attachment: Small text file with link containing recipient email address severity medium
• Attachment: Suspicious employee policy update document lure severity medium
• Attachment: SVG files with evasion elements severity high
• BEC/Fraud: Job scam fake thread or plaintext pivot to freemail severity medium
• BEC/Fraud: Reply-chain manipulation with urgent keywords and self-reply severity medium
• BEC/Fraud: Scam lure with freemail pivot severity low
• BEC/Fraud: Urgent language and suspicious sending/infrastructure patterns severity medium
• Body HTML: Recipient SLD in HTML class severity medium
• Body: HTML whitespace stuffing with short initial message severity medium
• Brand impersonation: Adobe (QR code) severity high
• Brand impersonation: Adobe Sign with suspicious indicators severity high
• Brand impersonation: Bank of America severity high
• Brand impersonation: File sharing notification with template artifacts severity low
• Brand impersonation: Google Drive fake file share severity medium
• Brand impersonation: Hulu severity medium
• Brand impersonation: LastPass severity high
• Brand impersonation: Mailgun severity medium
• Brand impersonation: Meta and subsidiaries severity medium
• Brand impersonation: Microsoft (QR code) severity high
• Brand impersonation: Microsoft Planner with suspicious link severity medium
• Brand impersonation: Microsoft with low reputation links severity medium
• Brand impersonation: Netflix severity low
• Brand impersonation: Norton severity low
• Brand impersonation: Sharepoint fake file share severity medium
• Business Email Compromise (BEC) attempt with masked recipients and reply-to mismatch (unsolicited) severity medium
• Callback phishing solicitation in message body severity medium
• Callback phishing via Apple ID display name abuse severity high
• Commonly abused sender TLD with engaging language severity medium
• Credential phishing content and link (untrusted sender) severity high
• Credential phishing language and suspicious indicators (unknown sender) severity medium
• Credential phishing: 'Secure message' and engaging language severity medium
• Credential phishing: AWS Lambda URL with recipient targeting severity medium
• Credential phishing: Email delivery failure impersonation severity high
• Credential phishing: Engaging language and other indicators (untrusted sender) severity medium
• Credential phishing: Fake password expiration from new and unsolicited sender severity medium
• Credential phishing: Generic document share template severity low
• Credential phishing: Generic document sharing severity medium
• Credential phishing: Re-Authentication lure severity high
• Credential phishing: Suspicious e-sign agreement document notification severity medium
• Credential Phishing: Suspicious language, link, recipients and other indicators severity medium
• Deceptive Dropbox mention severity medium
• Display name and subject impersonation using recipient SLD (new sender) severity medium
• Display name impersonation using recipient SLD severity medium
• EML attachment with credential theft language (unknown sender) severity high
• Fake email quarantine notification severity high
• Fake shipping notification with suspicious language severity medium
• Fake thread with suspicious indicators severity medium
• Fake voicemail notification (untrusted sender) severity medium
• Fake Zoho Sign template abuse severity medium
• Fake Zoom meeting invite with suspicious link severity medium
• Free subdomain link with credential theft indicators severity high
• Google Accelerated Mobile Pages (AMP) abuse severity medium
• Headers: Invalid recipient domain with mismatched reply-to from new sender severity medium
• Headers: Self-sender using Microsoft CompAuth bypass with credential theft content severity high
• HTML smuggling containing recipient email address severity medium
• Impersonation using recipient domain (untrusted sender) severity medium
• Impersonation: Recipient organization in sender display name with credential theft image severity medium
• Impersonation: SharePoint reply header anomaly severity medium
• Inbound message from popular service via newly observed distribution list severity medium
• Investor solicitation with organization targeting severity medium
• Invoicera infrastructure abuse severity medium
• Job scam (unsolicited sender) severity low
• Link abuse: Self-service creation platform link with suspicious recipient behavior severity high
• Link: Base64 encoded recipient address in URL fragment with hex subdomain severity high
• Link: Base64 encoded recipient address in URL fragment with subject hash severity low
• Link: Commonly Abused Web Service redirecting to ZIP file severity medium
• Link: Credential phishing link with undisclosed recipients severity medium
• Link: Credential theft with Cloudflare tunnel and recipient targeting severity high
• Link: Credential theft with invisible Unicode character in page title from unsolicited sender severity high
• Link: Display text matches subject line severity medium
• Link: File sharing impersonation with suspicious language and sending patterns severity medium
• Link: Free file hosting with undisclosed recipients severity medium
• Link: Free subdomain host with undisclosed recipients severity medium
• Link: IPFS severity medium
• Link: JavaScript obfuscation with Telegram bot integration severity high
• Link: Mamba 2FA phishing kit severity high
• Link: Microsoft protected message with matching sender and recipient addresses severity medium
• Link: PDF filename impersonation with credential theft language severity medium
• Link: Personal SharePoint with invalid recipients and credential theft language severity medium
• Link: Personalized URL with recipient address on commonly abused web service severity medium
• Link: QR Code with suspicious language (untrusted sender) severity medium
• Link: Recipient domain in URL path severity high
• Link: Recipient email address in 'eta' parameter severity high
• Link: Self-sender credential theft with configuration placeholder severity high
• Link: Self-sender with sender org in subject and credential theft indicator severity high
• Link: Self-sent message with quarterly document review request severity critical
• Link: Self-sent PDF lure with subject correlation severity medium
• Link: SharePoint OneNote or PDF link with self sender behavior severity medium
• Link: Single character path with credential theft body and self sender behavior or invalid recipient severity medium
• Link: Spam website with evasion indicators severity low
• Link: Suspicious file retrieval with recipient targeting severity high
• Link: Suspicious URL with recipient targeting and special characters severity high
• Link: SVG with embedded recipient data severity high
• Link: Tax document lure Portuguese/Spanish with suspicious domains severity medium
• Link: Tycoon2FA phishing kit (non-exhaustive) severity high
• Link: Unsolicited email contains link leading to Tycoon URL structure severity high
• Link: URL redirecting to blob URL severity medium
• Link: URL shortener with copy-paste instructions and credential theft language severity low
• Link: WordPress admin targeting with recipient identifier in URL fragment severity high
• Mass campaign: Cross Site Scripting (XSS) attempt severity medium
• Mass campaign: recipient address in subject, body, and link (untrusted sender) severity medium
• Message traversed multiple onmicrosoft.com tenants severity medium
• Microsoft infrastructure abuse with suspicious patterns severity high
• QR Code with suspicious indicators severity high
• Reconnaissance: All recipients cc/bcc'd or undisclosed severity low
• Reconnaissance: Hotel booking reply-to redirect severity medium
• Reconnaissance: Large unknown recipient list severity low
• Reconnaissance: Short generic greeting message severity medium
• Request for Quote or Purchase (RFQ|RFP) with suspicious sender or recipient pattern severity medium
• Salesforce infrastructure abuse severity medium
• Self-sender with copy/paste instructions and suspicious domains (French/Français) severity medium
• Self-sent fake PDF attachment with misleading link severity low
• Service abuse: Adobe legitimate domain with document approval language severity medium
• Service abuse: Cisco secure email service with financial request severity high
• Service Abuse: Nifty.com with impersonation severity medium
• Service abuse: Sendgrid credential theft with personalized request targeting single recipient severity medium
• Service Abuse: Zoom with freemail reply-to and recipient address in greeting severity medium
• Sharepoint file share with suspicious recipients pattern severity medium
• Sharepoint online with external recipients and external display name severity medium
• Spam/fraud: Predatory journal/research paper request severity medium
• Spam: Fake dating profile notification severity low
• Spam: Link to blob.core.windows.net from new domain (<30d) severity medium
• Spam: Single recipient duplicated in cc severity medium
• Spam: Unsolicited malformed PDF severity low
• Spam: Unsolicited WordPress account creation or password reset request severity low
• Suspicious recipient pattern and language with low reputation link to login severity medium
• Suspicious recipients pattern with NLU credential theft indicators severity medium
• Suspicious recipients pattern with no Compauth pass and suspicious content severity medium
• Suspicious request for financial information severity high
• Suspicious subject with long procedurally generated text blob severity medium
• Targeting: Specific AOL address severity medium
• VIP / Executive impersonation in subject (untrusted) severity medium
• Xero infrastructure abuse severity medium