Message Attachments
| Attribute group | Sample | Rule |
|---|---|---|
| attachments (collection) | N | Y |
attachments (collection)
#Description
Message Data Model attribute: attachments
Fields #
| Name | Description |
|---|---|
| content_disposition | Content-Disposition type, typically 'attachment' or 'inline' |
| content_id | Content-ID extracted from the MIME payload; is stripped of leading and trailing <> characters |
| content_type | Content-Type extracted from the MIME payload |
| file_extension | File extension from context such as headers |
| file_name | File name |
| file_type | File type determined by looking at the magic bytes in the file |
| md5 | MD5 hash of the raw contents |
| sha1 | SHA1 hash of the raw contents |
| sha256 | SHA256 hash of the raw contents |
| size | Size of the file in bytes |
Common Indicators #
Positive field/value combinations most frequently checked by detection rules attached to this catalog entry, derived from cross-vendor predicate analysis. This is separate from Fields accounting, which also includes exclusions and counts distinct attached rules.
| Field | Kind | Value | Rules | Vendors |
|---|---|---|---|---|
type.inbound | eq | true | 400 rules | mql |
profile.by_sender | func_call | profile.by_sender().any_messages_malicious_or_spam | 75 rules | mql |
profile.by_sender | func_call | profile.by_sender().prevalence in ("new", "outlier") | 17 rules | mql |
attachments | length_compare | 0 | 26 rules | mql |
attachments | length_compare | 1 | 24 rules | mql |
attachments | length_compare | 3 | 7 rules | mql |
attachments | length_compare | 3 | 6 rules | mql |
body.current_thread.text | is_null | | 14 rules | mql |
profile.by_sender_email | func_call | profile.by_sender_email().any_messages_malicious_or_spam | 14 rules | mql |
profile.by_sender_email | func_call | profile.by_sender_email().prevalence in ("new", "outlier") | 8 rules | mql |
sender.email.domain.root_domain | macro | sender.email.domain.root_domain not in org_domains | 13 rules | mql |
sender.email.domain.domain | macro | sender.email.domain.domain in org_domains | 11 rules | mql |
headers.references | length_compare | 0 | 8 rules | mql |
length | func_call | length(filter(attachments, .file_type not in $file_types_images)) == 0 | 7 rules | mql |
body.links | length_compare | 0 | 6 rules | mql |
Detection Rules #
Full rule details for this catalog entry, including ATT&CK technique mappings and native queries →Sublime MQL #