Message Attachments

Attribute group	Rule
attachments (collection)	Y

`attachments (collection)`

Message Data Model attribute: attachments

Name	Description
content_id	Content-ID extracted from the MIME payload; is stripped of leading and trailing <> characters
content_type	Content-Type extracted from the MIME payload
file_extension	File extension from context such as headers
file_name	File name
file_type	File type determined by looking at the magic bytes in the file
md5	MD5 hash of the raw contents
sha1	SHA1 hash of the raw contents
sha256	SHA256 hash of the raw contents
size	Size of the file in bytes

Field/value combinations most frequently checked by detection rules targeting this event, derived from cross-vendor predicate analysis.

Field	Kind	Value	Rules	Vendors
`type.inbound`	eq	`true`	377 rules	mql
`profile.by_sender`	func_call	`profile.by_sender().any_messages_malicious_or_spam`	74 rules	mql
`profile.by_sender`	func_call	`profile.by_sender().prevalence in (new, outlier)`	17 rules	mql
`attachments`	length_compare	`0`	37 rules	mql
`attachments`	length_compare	`1`	28 rules	mql
`attachments`	length_compare	`3`	13 rules	mql
`body.current_thread.text`	is_null		14 rules	mql
`body.current_thread.text`	length_compare	`0`	8 rules	mql
`body.current_thread.text`	length_compare	`10`	6 rules	mql
`profile.by_sender_email`	func_call	`profile.by_sender_email().any_messages_malicious_or_spam`	14 rules	mql
`profile.by_sender_email`	func_call	`profile.by_sender_email().prevalence in (new, outlier)`	8 rules	mql
`type.outbound`	eq	`true`	13 rules	mql
`filter(attachments, .file_type == 'pdf')`	length_compare	`1`	7 rules	mql
`filter(attachments, .file_type not in $file_types_images)`	length_compare	`0`	7 rules	mql
`sender.email.email`	cross_field_compare	`recipients.to[0].email.email`	7 rules	mql

Attachment: 7z Archive Containing RAR File source medium: Detects 7z archive attachments that contain RAR files, which may be used to evade detection by nesting compressed file formats.
Attachment: Adobe image lure in body or attachment with suspicious link source medium: Detects Adobe phishing messages with an Adobe logo in the body or attachment, with suspicious link language.
Brand impersonation: Adobe (QR code) source high: Detects messages using Adobe image based lures, referencing or including a QR code from an Unsolicited sender. These messages often lead users to phishing sites or initiate unwanted downloads.