Message Body

Attribute group	Rule
body	Y
body.current_thread	Y
body.html	Y
body.ips (collection)	Y
body.links (collection)	Y
body.plain	Y
body.previous_threads (collection)	Y

`body`

Description

Message Data Model attribute: body

Fields #

Name	Description
html
ips	IP Addresses located in the body
links	All links found in the body of the message, unique by the target and display text/url.
previous_threads	The previous texts threads of the message'

Common Indicators #

Field/value combinations most frequently checked by detection rules targeting this event, derived from cross-vendor predicate analysis.

Field	Kind	Value	Rules	Vendors
`type.inbound`	eq	`true`	548 rules	mql
`profile.by_sender`	func_call	`profile.by_sender().any_messages_malicious_or_spam`	96 rules	mql
`profile.by_sender`	func_call	`profile.by_sender().prevalence in (new, outlier)`	30 rules	mql
`body.links`	length_compare	`0`	85 rules	mql
`body.links`	length_compare	`10`	50 rules	mql
`body.links`	length_compare	`15`	12 rules	mql
`attachments`	length_compare	`0`	49 rules	mql
`attachments`	length_compare	`1`	11 rules	mql
`recipients.to`	length_compare	`1`	36 rules	mql
`recipients.to`	length_compare	`0`	27 rules	mql
`headers.references`	length_compare	`0`	27 rules	mql
`headers.in_reply_to`	is_null		26 rules	mql
`body.previous_threads`	length_compare	`0`	23 rules	mql
`recipients.cc`	length_compare	`0`	14 rules	mql
`recipients.bcc`	length_compare	`0`	13 rules	mql

Detection Rules #

Full rule details for this event, including ATT&CK technique mappings and native queries →

Sublime MQL #

Service abuse: Amazon invitation with suspected callback phishing source medium: Detects Amazon's no-reply address with a subject about invitation sending, containing phone numbers within HTML header elements. This pattern is commonly used to trick recipients into calling fraudulent customer service numbers.
Service Abuse: Box file sharing with credential phishing intent source medium: Detects abuse of Box's legitimate infrastructure for credential phishing attacks.↳ also matches body.current_thread, body.links (collection)
Abuse: Cloudflare Workers Hosted EvilTokens Domain Structure source high: Detects messages containing links to Cloudflare Workers domains that follow naming patterns designed to impersonate legitimate services such as Adobe, DocuSign, OneDrive, SharePoint, and voicemail systems. These domains use suspicious alphanumeric identifiers and may be used to deceive recipients into believing they are accessing trusted services.↳ also matches body.links (collection)

Show 17 more (550 total) on the rules page

`body.current_thread`

Description

Message Data Model attribute: body.current_thread

Fields #

Name	Description
banners	All warning banners found in the body of the message.
banners[].text	The text content from the warning banner.
links	All links found in the given thread, unique by the target and display text/url.
links[].display_text	The text of a hyperlink, if it's not a URL
links[].display_url.domain.root_domain	The root domain, including the TLD
links[].display_url.domain.sld	Second-level domain, e.g. 'windows' for the domain 'windows.net'
links[].display_url.domain.subdomain	Subdomain, e.g. 'drive' for the domain 'drive.google.com'
links[].display_url.path	Everything after the TLD and before the query parameters
links[].display_url.url	Full URL
links[].href_url.domain
links[].href_url.domain.domain	The fully qualified domain name (FQDN). This may not always be routable, e.g. when an email address contains a domain that is just a TLD with no SLD, e.g. foo@WIN-bar
links[].href_url.domain.root_domain	The root domain, including the TLD
links[].href_url.domain.sld	Second-level domain, e.g. 'windows' for the domain 'windows.net'
links[].href_url.domain.subdomain	Subdomain, e.g. 'drive' for the domain 'drive.google.com'
links[].href_url.domain.tld	The domain's top-level domain. E.g. the TLD of google.com is 'com'
links[].href_url.domain.valid	Whether the domain is valid
links[].href_url.fragment	Fragment identifier; the text following the # in the URL (also called the anchor tag)
links[].href_url.path	Everything after the TLD and before the query parameters
links[].href_url.query_params	The full query parameters of the URL
links[].href_url.query_params_decoded	The decoded query parameters of the URL
links[].href_url.query_params_decoded['action'][]
links[].href_url.query_params_decoded['domain']
links[].href_url.query_params_decoded['domain'][]
links[].href_url.query_params_decoded['url']
links[].href_url.rewrite.encoders	List of detected URL rewrite encoders while unraveling the URL
links[].href_url.rewrite.original	Original URL without any unraveling URL rewrites
links[].href_url.scheme	Protocol for the URL request, e.g. http
links[].href_url.url	Full URL
links[].mismatched	Whether the display URL and href URL root domains are mismatched (i.e. .href_url.domain.root_domain != .display_url.domain.root_domain, where both are not null and valid domains)
links[].parser	The parser that was used to derived the link
links[].visible	Whether the link is visible to a human when previewing an email or page
preamble	The preamble text from the thread, typically the headers of a reply or forward. Things like From, Sent, Subject, saved as one big multiline string. This doesn't include banners.
text	The text content from the latest reply/forward in a message thread. This typically excludes content from forwarded messages and warning banners.

Common Indicators #

Field/value combinations most frequently checked by detection rules targeting this event, derived from cross-vendor predicate analysis.

Field	Kind	Value	Rules	Vendors
`type.inbound`	eq	`true`	480 rules	mql
`type.outbound`	eq	`true`	159 rules	mql
`profile.by_sender`	func_call	`profile.by_sender().any_messages_malicious_or_spam`	72 rules	mql
`attachments`	length_compare	`0`	65 rules	mql
`body.links`	length_compare	`0`	50 rules	mql
`body.links`	length_compare	`10`	21 rules	mql
`recipients.to`	length_compare	`1`	43 rules	mql
`recipients.to`	length_compare	`0`	31 rules	mql
`headers.references`	length_compare	`0`	37 rules	mql
`headers.in_reply_to`	is_null		36 rules	mql
`body.current_thread.text`	contains	`subscription`	23 rules	mql
`body.current_thread.text`	contains	`invoice`	21 rules	mql
`body.current_thread.text`	contains	`transaction`	21 rules	mql
`body.current_thread.text`	contains	`antivirus`	20 rules	mql
`headers.reply_to`	length_compare	`0`	22 rules	mql

Detection Rules #

Full rule details for this event, including ATT&CK technique mappings and native queries →

Sublime MQL #

Service abuse: Behance document sharing with suspicious language source medium: Detects messages containing document sharing language with a single Behance gallery link, potentially indicating abuse of the legitimate Adobe Behance platform for malicious purposes.
Service Abuse: Box file sharing with credential phishing intent source medium: Detects abuse of Box's legitimate infrastructure for credential phishing attacks.↳ also matches body, body.links (collection)
Service abuse: Evernote link source low: Detects inbound messages containing a link whose effective destination resolves to evernote.com, where the link text uses document-sharing or e-signature language (e.g., view, open, download, review) and the sender is not from evernote.com. The message body is also classified by an NLU model as exhibiting credential theft or business email compromise intent, indicating abuse of Evernote's legitimate hosting infrastructure to deliver malicious content.

Show 17 more (642 total) on the rules page

`body.html`

Description

Message Data Model attribute: body.html

Fields #

Name	Description
display_text	Visible text of the HTML document, with invisible characters removed and non-ASCII characters converted to ASCII spaces.
inner_text	Inner text of the HTML document that doesn't include HTML tags.
raw	Decoded raw content of a body text type (text/[subtype] section)

Common Indicators #

Field/value combinations most frequently checked by detection rules targeting this event, derived from cross-vendor predicate analysis.

Field	Kind	Value	Rules	Vendors
`body.html.raw`	is_null		6 rules	mql
`body.html.inner_text`	contains	`+1`	4 rules	mql
`body.html.inner_text`	contains	`antivirus`	4 rules	mql
`body.html.inner_text`	contains	`btc`	4 rules	mql
`body.html.inner_text`	contains	`call`	4 rules	mql
`body.html.inner_text`	contains	`cancel`	4 rules	mql
`body.html.inner_text`	contains	`detected unusual transactions`	4 rules	mql
`body.html.inner_text`	contains	`done by you`	4 rules	mql
`body.html.inner_text`	contains	`fraud alert`	4 rules	mql
`body.html.inner_text`	contains	`fruad alert`	4 rules	mql
`body.html.inner_text`	contains	`get in touch with our`	4 rules	mql
`body.html.inner_text`	contains	`invoice`	4 rules	mql
`body.html.inner_text`	regex_match	`\+𝟭\|𝗽𝗮𝘆𝗺𝗲𝗻𝘁\|𝗛𝗲𝗹𝗽 𝗗𝗲𝘀𝗸\|𝗿𝗲𝗳𝘂𝗻𝗱\|𝗮𝗻𝘁𝗶𝘃𝗶𝗿𝘂𝘀\|𝗰𝗮𝗹𝗹\|𝗰𝗮𝗻𝗰𝗲𝗹`	5 rules	mql
`body.current_thread.text`	length_compare	`500`	4 rules	mql
`body.current_thread.text`	regex_match	`note from.{0,50}(?:call\|reach\|contact\|paypal)`	4 rules	mql

Detection Rules #

Full rule details for this event, including ATT&CK technique mappings and native queries →

Sublime MQL #

Service abuse: Google Firebase sender address with suspicious content source low: Detects messages from Firebase hosted domains that contain suspicious indicators such as emojis, spam keywords, unusual link patterns, or freemail registrant information.↳ also matches body, body.current_thread, body.links (collection), body.plain
Service abuse: Google classroom solicitation source medium: Detects messages spoofing Google Classroom notifications that contain WhatsApp contact information, phone numbers, or sexually explicit content. The rule identifies emails from no-reply@classroom.google.com that include WhatsApp invitations, emojis in the subject line, or explicit sexual language, as well as phone numbers and WhatsApp references in message screenshots from first-time senders.↳ also matches body.current_thread
Service Abuse: HelloSign share with suspicious sender or document name source medium: The detection rule is designed to identify messages sent from HelloSign that notify recipients about a shared file and contain suspicious content either in the document or the sender's display name.↳ also matches body, body.current_thread

Show 17 more (130 total) on the rules page

`body.ips (collection)`

Description

Message Data Model attribute: body.ips

Fields #

Name	Description
ip	The IP in canonical form

Detection Rules #

Full rule details for this event, including ATT&CK technique mappings and native queries →

Sublime MQL #

Credential phishing: Engaging language and other indicators (untrusted sender) source medium: Message contains various suspicious indicators as well as engaging language resembling credential theft from an untrusted sender. ↳ also matches body, body.current_thread, body.links (collection)

`body.links (collection)`

Description

Message Data Model attribute: body.links

Fields #

Name	Description
display_text	The text of a hyperlink, if it's not a URL
display_url.domain
display_url.domain.root_domain	The root domain, including the TLD
display_url.domain.tld	The domain's top-level domain. E.g. the TLD of google.com is 'com'
display_url.path	Everything after the TLD and before the query parameters
display_url.scheme	Protocol for the URL request, e.g. http
display_url.url	Full URL
href_url.domain
href_url.domain.domain	The fully qualified domain name (FQDN). This may not always be routable, e.g. when an email address contains a domain that is just a TLD with no SLD, e.g. foo@WIN-bar
href_url.domain.punycode	Interpreted punycode if the domain starts with xn--. For example, if 'domain' is 'xn--ublimesecurity-4xc.com' then 'punycode' is śublimesecurity.com
href_url.domain.root_domain	The root domain, including the TLD
href_url.domain.sld	Second-level domain, e.g. 'windows' for the domain 'windows.net'
href_url.domain.subdomain	Subdomain, e.g. 'drive' for the domain 'drive.google.com'
href_url.domain.tld	The domain's top-level domain. E.g. the TLD of google.com is 'com'
href_url.domain.valid	Whether the domain is valid
href_url.fragment	Fragment identifier; the text following the # in the URL (also called the anchor tag)
href_url.ip.ip	The IP in canonical form
href_url.ip.translation.encoders	The radix/form encodings detected on a non-standard IPv4 host that was decoded into 'ip'
href_url.ip.translation.v4_to_v6	Whether 'Original' is IPv4-mapped-IPv6
href_url.password	The password specified before the domain name
href_url.path	Everything after the TLD and before the query parameters
href_url.query_params	The full query parameters of the URL
href_url.query_params_decoded	The decoded query parameters of the URL
href_url.query_params_decoded['domain']
href_url.query_params_decoded['domain'][]
href_url.query_params_decoded['email']
href_url.query_params_decoded['eta'][]
href_url.query_params_decoded['key']
href_url.query_params_decoded['login']
href_url.query_params_decoded['mode']
href_url.query_params_decoded['pwd']
href_url.query_params_decoded['redirect']
href_url.query_params_decoded['tracking_number']
href_url.query_params_decoded['upn']
href_url.query_params_decoded['url']
href_url.query_params_decoded[]	The decoded query parameters of the URL
href_url.query_params_decoded[][]	The decoded query parameters of the URL
href_url.rewrite.encoders	List of detected URL rewrite encoders while unraveling the URL
href_url.rewrite.original	Original URL without any unraveling URL rewrites
href_url.scheme	Protocol for the URL request, e.g. http
href_url.url	Full URL
href_url.username	The username specified before the domain name of the URL
mismatched	Whether the display URL and href URL root domains are mismatched (i.e. .href_url.domain.root_domain != .display_url.domain.root_domain, where both are not null and valid domains)
parser	The parser that was used to derived the link
visible	Whether the link is visible to a human when previewing an email or page

Common Indicators #

Field/value combinations most frequently checked by detection rules targeting this event, derived from cross-vendor predicate analysis.

Field	Kind	Value	Rules	Vendors
`type.inbound`	eq	`true`	443 rules	mql
`profile.by_sender`	func_call	`profile.by_sender().any_messages_malicious_or_spam`	83 rules	mql
`profile.by_sender`	func_call	`profile.by_sender().prevalence in (new, outlier)`	26 rules	mql
`profile.by_sender`	func_call	`profile.by_sender().prevalence != common`	7 rules	mql
`body.links`	length_compare	`0`	62 rules	mql
`body.links`	length_compare	`10`	41 rules	mql
`body.links`	length_compare	`20`	10 rules	mql
`body.links`	length_compare	`15`	8 rules	mql
`attachments`	length_compare	`0`	37 rules	mql
`headers.in_reply_to`	is_null		24 rules	mql
`headers.references`	length_compare	`0`	24 rules	mql
`recipients.to`	length_compare	`1`	22 rules	mql
`body.previous_threads`	length_compare	`0`	11 rules	mql
`subject.subject`	contains	`shared`	8 rules	mql
`body.current_thread.text`	length_compare	`0`	7 rules	mql

Detection Rules #

Full rule details for this event, including ATT&CK technique mappings and native queries →

Sublime MQL #

Service Abuse: Box file sharing with credential phishing intent source medium: Detects abuse of Box's legitimate infrastructure for credential phishing attacks.↳ also matches body, body.current_thread
Abuse: Cloudflare Workers Hosted EvilTokens Domain Structure source high: Detects messages containing links to Cloudflare Workers domains that follow naming patterns designed to impersonate legitimate services such as Adobe, DocuSign, OneDrive, SharePoint, and voicemail systems. These domains use suspicious alphanumeric identifiers and may be used to deceive recipients into believing they are accessing trusted services.↳ also matches body
Service abuse: Google Firebase sender address with suspicious content source low: Detects messages from Firebase hosted domains that contain suspicious indicators such as emojis, spam keywords, unusual link patterns, or freemail registrant information.↳ also matches body, body.current_thread, body.html, body.plain

Show 17 more (444 total) on the rules page

`body.plain`

Description

Message Data Model attribute: body.plain

Fields #

Name	Description
raw	Decoded raw content of a body text type (text/[subtype] section)

Common Indicators #

Field/value combinations most frequently checked by detection rules targeting this event, derived from cross-vendor predicate analysis.

Field	Kind	Value	Rules	Vendors
`body.plain.raw`	is_null		3 rules	mql
`body.plain.raw`	regex_match	`[\x{1F300}-\x{1F5FF}\x{1F600}-\x{1F64F}\x{1F680}-\x{1F6FF}\x{1F700}-\x{1F77F}\x{1F780}-\x{1F7FF}\x{1F900}-\x{1F9FF}\x{2600}-\x{26FF}\x{2700}-\x{27BF}\x{2300}-\x{23FF}]`	4 rules	mql
`subject.subject`	regex_match	`[\x{1F300}-\x{1F5FF}\x{1F600}-\x{1F64F}\x{1F680}-\x{1F6FF}\x{1F700}-\x{1F77F}\x{1F780}-\x{1F7FF}\x{1F900}-\x{1F9FF}\x{2600}-\x{26FF}\x{2700}-\x{27BF}\x{2300}-\x{23FF}]`	3 rules	mql
`beta.ocr(file.message_screenshot()).text`	contains	`received a document`	2 rules	mql
`beta.ocr(file.message_screenshot()).text`	contains	`shared a document`	2 rules	mql
`beta.ocr(file.message_screenshot()).text`	contains	`shared a file with you`	2 rules	mql
`beta.ocr(file.message_screenshot()).text`	contains	`shared this document`	2 rules	mql
`beta.ocr(file.message_screenshot()).text`	contains	`shared with you`	2 rules	mql
`body.html.raw`	regex_match	`(background-color:\|background:\|bgcolor=)(.)?#(00a4ef\|0078d7\|8bb737\|04a5f0\|059EE4\|05A6F0)`	2 rules	mql
`body.html.raw`	regex_match	`(background-color:\|background:\|bgcolor=)(.)?#(04a1d6\|04B5F0\|05a1e8\|00A4EF\|01a4ef\|04a5f0)`	2 rules	mql
`body.html.raw`	regex_match	`(background-color:\|background:\|bgcolor=)(.)?#(7cbf42\|81bb05\|e05c35\|7AB206\|81BC06)`	2 rules	mql
`body.html.raw`	regex_match	`(background-color:\|background:\|bgcolor=)(.)?#(FFCA07\|f7b408\|FFB900\|FFCA08\|ffb901\|ffba07)`	2 rules	mql
`body.html.raw`	regex_match	`(background-color:\|background:\|bgcolor=)(.)?#(f65314\|f65d35\|49a1e8\|E74F23\|F35325)`	2 rules	mql
`body.html.raw`	regex_match	`(background-color:\|background:\|bgcolor=)(.)?#(ffb900\|ffba07\|f4bc41\|F2B108\|FFBA08)`	2 rules	mql
`body.html.raw`	regex_match	`(background-color:\|background:\|bgcolor=)(.)?(#)?(36ba57\|3eb55d\|7db606\|7FBA00\|36ba58\|green)`	2 rules	mql

Detection Rules #

Full rule details for this event, including ATT&CK technique mappings and native queries →

Sublime MQL #

Service abuse: Google Firebase sender address with suspicious content source low: Detects messages from Firebase hosted domains that contain suspicious indicators such as emojis, spam keywords, unusual link patterns, or freemail registrant information.↳ also matches body, body.current_thread, body.html, body.links (collection)
Anthropic Magic String in HTML source low: Detects messages containing the specific test string 'ANTHROPIC_MAGIC_STRING' in the plain text body content.↳ also matches body.html
Attachment: Callback phishing solicitation via pdf file source high: A fraudulent invoice/receipt found in a pdf attachment. Callback Phishing is an attempt by an attacker to solicit the victim (recipient) to call a phone number. The resulting interaction could lead to a multitude of attacks ranging from Financial theft, Remote Access Trojan (RAT) Installation or Ransomware Deployment. ↳ also matches body.current_thread, body.html

Show 17 more (34 total) on the rules page

`body.previous_threads (collection)`

Description

Message Data Model attribute: body.previous_threads

Fields #

Name	Description
links	All links found in the given thread, unique by the target and display text/url.
links[].href_url.domain.root_domain	The root domain, including the TLD
links[].href_url.scheme	Protocol for the URL request, e.g. http
links[].href_url.url	Full URL
preamble	The preamble text from the thread, typically the headers of a reply or forward. Things like From, Sent, Subject, saved as one big multiline string. This doesn't include banners.
recipients.cc	List of 'cc' Mailbox objects
recipients.cc[].email.domain.domain	The fully qualified domain name (FQDN). This may not always be routable, e.g. when an email address contains a domain that is just a TLD with no SLD, e.g. foo@WIN-bar
recipients.to	List of 'to' Mailbox objects
recipients.to[].display_name	Display name
recipients.to[].email.domain.domain	The fully qualified domain name (FQDN). This may not always be routable, e.g. when an email address contains a domain that is just a TLD with no SLD, e.g. foo@WIN-bar
recipients.to[].email.email	Full email address
sender.display_name	Display name
sender.email.domain.domain	The fully qualified domain name (FQDN). This may not always be routable, e.g. when an email address contains a domain that is just a TLD with no SLD, e.g. foo@WIN-bar
sender.email.domain.root_domain	The root domain, including the TLD
sender.email.email	Full email address
subject.base	Subject of the email with tags and reply/forward indicators removed
subject.is_auto_reply	Indicates if the subject of the email is an automatic reply
subject.is_forward	Indicates if the subject of the email is a forward
text	The text content from the latest reply/forward in a message thread. This typically excludes content from forwarded messages and warning banners.

Common Indicators #

Field/value combinations most frequently checked by detection rules targeting this event, derived from cross-vendor predicate analysis.

Field	Kind	Value	Rules	Vendors
`body.previous_threads`	length_compare	`1`	4 rules	mql
`filter(flatten([recipients.to, recipients.cc, recipients.bcc]), .email.domain.root_domain in $org_domains)`	length_compare	`1`	3 rules	mql
`body.previous_threads[].recipients.to`	length_compare	`1`	2 rules	mql
`coalesce(body.plain.raw, body.html.display_text)`	length_compare	`6000`	2 rules	mql
`filter(attachments, .file_type == 'pdf')`	length_compare	`0`	1 rule	mql
`headers.in_reply_to`	is_not_null		1 rule	mql

Detection Rules #

Full rule details for this event, including ATT&CK technique mappings and native queries →

Sublime MQL #

Attachment: Encrypted PDF with credential theft body source medium: Attached PDF is encrypted, and email body contains credential theft language. Seen in-the-wild impersonating e-fax services.↳ also matches body, body.current_thread
BEC/Fraud: Reply-chain manipulation with urgent keywords and self-reply source medium: Detects suspicious reply messages with urgent language in sender name or email address, minimal body content, and the sender's email address appearing in previous thread content, indicating a self reply.↳ also matches body, body.current_thread
Business Email Compromise: Request for mobile number via reply thread hijacking source medium: This rule detects BEC attacks that use reply threads to solicit mobile numbers, evading detection rules that exclude RE: subjects.↳ also matches body

Show 17 more (23 total) on the rules page

References #

Sublime Message Data Model