Message Headers

Attribute group	Rule
headers (collection)	Y
headers.auth_summary	Y
headers.domains (collection)	Y
headers.hops (collection)	Y
headers.ips (collection)	Y
headers.reply_to (collection)	Y
headers.return_path	Y
headers.x_authenticated_domain	Y
headers.x_authenticated_sender	Y
headers.x_originating_ip	Y

`headers (collection)`

Description

Message Data Model attribute: headers

Fields #

Name	Description
domains	All domains found in the Received headers
hops	List of hops the message took from Sender to Recipient
in_reply_to	In-Reply-To header value which identifies its parent message if exists
ips	All IP addresses found in the Received headers
mailer	X-Mailer or User-Agent extracted from headers
message_id	Message-ID extracted from the header
references	The Message-IDs of the other messages within this chain
references[]	The Message-IDs of the other messages within this chain
reply_to	Where replies should be delivered to

Common Indicators #

Field/value combinations most frequently checked by detection rules targeting this event, derived from cross-vendor predicate analysis.

Field	Kind	Value	Rules	Vendors
`profile.by_sender`	func_call	`profile.by_sender().any_messages_malicious_or_spam`	58 rules	mql
`headers.references`	length_compare	`0`	46 rules	mql
`headers.in_reply_to`	is_null		45 rules	mql
`body.links`	length_compare	`0`	36 rules	mql
`body.links`	length_compare	`10`	19 rules	mql
`headers.reply_to`	length_compare	`0`	32 rules	mql
`recipients.to`	length_compare	`0`	24 rules	mql
`recipients.to`	length_compare	`1`	23 rules	mql
`headers.auth_summary.dmarc.pass`	eq	`true`	18 rules	mql
`headers.auth_summary.spf.pass`	eq	`true`	18 rules	mql
`profile.by_sender_email`	func_call	`profile.by_sender_email().any_messages_malicious_or_spam`	14 rules	mql
`profile.by_sender_email`	func_call	`profile.by_sender_email().prevalence in (new, outlier)`	9 rules	mql
`recipients.cc`	length_compare	`0`	13 rules	mql
`body.previous_threads`	length_compare	`0`	12 rules	mql
`recipients.bcc`	length_compare	`0`	12 rules	mql

Detection Rules #

Full rule details for this event, including ATT&CK technique mappings and native queries →

Sublime MQL #

Service abuse: DocSend share from newly registered domain source high: This Attack Surface Reduction (ASR) rule matches on DocSend notifications with recently registered reply-to domains.↳ also matches headers.auth_summary, headers.reply_to (collection)
Service abuse: DocuSign notification with suspicious sender or document name source medium: The detection rule is intended to match on messages sent from Docusign from a newly observed reply-to address which contains suspicious content within the document or sender display name.↳ also matches headers.auth_summary, headers.reply_to (collection)
Service abuse: DocuSign share from an unsolicited reply-to address source medium: DocuSign shares which contain a reply-to address or domain that has not been previously observed by the recipient organization.↳ also matches headers.auth_summary, headers.reply_to (collection)

Show 17 more (270 total) on the rules page

`headers.auth_summary`

Description

Message Data Model attribute: headers.auth_summary

Fields #

Name	Description
dmarc.details.from.domain	The fully qualified domain name (FQDN). This may not always be routable, e.g. when an email address contains a domain that is just a TLD with no SLD, e.g. foo@WIN-bar
dmarc.details.from.root_domain	The root domain, including the TLD
dmarc.pass	Whether the DMARC check passed
spf.details.designator	Email or domain of the designating body
spf.pass	Whether the SPF check passed

Common Indicators #

Field/value combinations most frequently checked by detection rules targeting this event, derived from cross-vendor predicate analysis.

Field	Kind	Value	Rules	Vendors
`type.inbound`	eq	`true`	452 rules	mql
`profile.by_sender`	func_call	`profile.by_sender().any_messages_malicious_or_spam`	92 rules	mql
`profile.by_sender`	func_call	`profile.by_sender().prevalence in (new, outlier)`	25 rules	mql
`attachments`	length_compare	`0`	44 rules	mql
`body.links`	length_compare	`0`	40 rules	mql
`body.links`	length_compare	`10`	26 rules	mql
`headers.auth_summary.dmarc.pass`	eq	`true`	36 rules	mql
`headers.auth_summary.spf.pass`	eq	`true`	32 rules	mql
`headers.in_reply_to`	is_null		29 rules	mql
`headers.references`	length_compare	`0`	29 rules	mql
`recipients.to`	length_compare	`0`	23 rules	mql
`profile.by_sender_email`	func_call	`profile.by_sender_email().any_messages_malicious_or_spam`	20 rules	mql
`headers.reply_to`	length_compare	`0`	16 rules	mql
`recipients.cc`	length_compare	`0`	14 rules	mql
`body.current_thread.text`	contains	`invoice`	13 rules	mql

Detection Rules #

Full rule details for this event, including ATT&CK technique mappings and native queries →

Sublime MQL #

Service abuse: Adobe Sign notification from an unsolicited reply-to address source medium: Identifies messages appearing to come from Adobe Sign signature notifications that contain a reply-to address not previously seen in organizational communications. This tactic exploits trust in legitimate Adobe services while attempting to establish unauthorized communication channels.
Service abuse: Behance document sharing with suspicious language source medium: Detects messages containing document sharing language with a single Behance gallery link, potentially indicating abuse of the legitimate Adobe Behance platform for malicious purposes.
Service abuse: DocSend share from newly registered domain source high: This Attack Surface Reduction (ASR) rule matches on DocSend notifications with recently registered reply-to domains.↳ also matches headers (collection), headers.reply_to (collection)

Show 17 more (454 total) on the rules page

`headers.domains (collection)`

Description

Message Data Model attribute: headers.domains

Fields #

Name	Description
domain	The fully qualified domain name (FQDN). This may not always be routable, e.g. when an email address contains a domain that is just a TLD with no SLD, e.g. foo@WIN-bar
root_domain	The root domain, including the TLD
tld	The domain's top-level domain. E.g. the TLD of google.com is 'com'

Common Indicators #

Field/value combinations most frequently checked by detection rules targeting this event, derived from cross-vendor predicate analysis.

Field	Kind	Value	Rules	Vendors
`beta.ocr(file.message_screenshot()).text`	contains	`review`	2 rules	mql
`beta.ocr(file.message_screenshot()).text`	contains	`view`	2 rules	mql
`body.current_thread.text`	contains	`blocked`	2 rules	mql
`body.current_thread.text`	contains	`notification`	2 rules	mql
`body.current_thread.text`	contains	`prevented`	2 rules	mql
`body.current_thread.text`	contains	`review`	2 rules	mql
`body.current_thread.text`	contains	`server error`	2 rules	mql
`body.current_thread.text`	contains	`unsubscribe`	2 rules	mql
`body.current_thread.text`	contains	`2884 sand hill road`	1 rule	mql
`body.current_thread.text`	contains	`menlo park, ca 94025`	1 rule	mql
`body.current_thread.text`	contains	`messages`	1 rule	mql
`body.current_thread.text`	length_compare	`250`	2 rules	mql
`body.current_thread.text`	length_compare	`700`	2 rules	mql
`filter(body.links, .href_url.scheme != 'mailto')`	length_compare	`0`	2 rules	mql
`sender.display_name`	regex_match	`[a-z0-9]+@[a-z]+`	2 rules	mql

Detection Rules #

Full rule details for this event, including ATT&CK technique mappings and native queries →

Sublime MQL #

Service Abuse: ExactTarget with suspicious sender indicators source high: Message originates from ExactTarget infrastructure but uses a suspicious sender domain, including overly long salesforce.com domains, awsapps.com domains, domains containing UTF-8 encoding characters, or a suspicious sender display name.↳ also matches headers (collection)
Attachment: Fake secure message and suspicious indicators source medium: Body contains language resembling credential theft, and an attached "secure message" from an untrusted sender.↳ also matches headers (collection), headers.auth_summary, headers.hops (collection)
EML attachment with credential theft language (unknown sender) source high: Identifies EML attachments that use credential theft language from unknown senders.↳ also matches headers (collection), headers.auth_summary

Show 17 more (50 total) on the rules page

`headers.hops (collection)`

Description

Message Data Model attribute: headers.hops

Fields #

Name	Description
authentication_results.compauth.verdict	Verdict of the compauth
authentication_results.dkim	Verdict of the Domain Keys Identified Mail check
authentication_results.dkim_details	List of details of the Domain Keys Identified Mail checks
authentication_results.dkim_details[].domain	Domain identified in the DKIM signature if any. This is the domain that's queried for the public key.
authentication_results.dmarc	Verdict of the Domain-based Message Authentication, Reporting & Conformance check
authentication_results.dmarc_details.from.domain	The fully qualified domain name (FQDN). This may not always be routable, e.g. when an email address contains a domain that is just a TLD with no SLD, e.g. foo@WIN-bar
authentication_results.spf	Verdict of the Sender Policy Framework
authentication_results.spf_details.designator	Email or domain of the designating body
fields	List of all raw header fields contained within this hop
fields[].name	The name of the field
fields[].value	The value contained within the field
index	Index indicates the order in which a hop occurred from sender to recipient
received.server.raw	The raw string of 'by' section
received.source.raw	The raw string of 'from' section
received_spf.designator	Email or domain of the designating body
signature.headers	Header fields signed by the algorithm

Common Indicators #

Field/value combinations most frequently checked by detection rules targeting this event, derived from cross-vendor predicate analysis.

Field	Kind	Value	Rules	Vendors
`headers.auth_summary.dmarc.pass`	is_null		4 rules	mql
`coalesce`	func_call	`coalesce(headers.auth_summary.dmarc.pass)`	3 rules	mql
`ml.nlu_classifier(body.current_thread.text).intents`	length_compare	`0`	3 rules	mql
`attachments`	length_compare	`8`	2 rules	mql
`beta.ocr(file.message_screenshot()).text`	contains	`docusign`	2 rules	mql
`beta.ocr(file.message_screenshot()).text`	regex_match	`Dokument (überprüfen\|prüfen\|unterschreiben\|geschickt)`	2 rules	mql
`beta.ocr(file.message_screenshot()).text`	regex_match	`important edocs`	2 rules	mql
`body.current_thread.text`	contains	`document portal`	2 rules	mql
`body.current_thread.text`	length_compare	`100`	2 rules	mql
`body.html.raw`	regex_match	`((<br\s/?>\s){20,}\|\n{20,})`	2 rules	mql
`body.html.raw`	regex_match	`(<p class=".?"><span style=".?"><o:p> </o:p></span></p>\s*){30,}`	2 rules	mql
`body.html.raw`	regex_match	`(<p> </p>\s*){7,}`	2 rules	mql
`body.html.raw`	regex_match	`(<p[^>]> </p>\s){7,}`	2 rules	mql
`body.html.raw`	regex_match	`(<p[^>]>\s <br>\s</p>\s){5,}`	2 rules	mql
`body.html.raw`	regex_match	`(<p[^>]>\s<br\s/?>\s</p>\s*){30,}`	2 rules	mql

Detection Rules #

Full rule details for this event, including ATT&CK technique mappings and native queries →

Sublime MQL #

Service Abuse: HelloSign share with suspicious sender or document name source medium: The detection rule is designed to identify messages sent from HelloSign that notify recipients about a shared file and contain suspicious content either in the document or the sender's display name.↳ also matches headers (collection), headers.auth_summary
Service abuse: HelloSign from an unsolicited sender address source low: Detects messages from HelloSign in which the document originates from a newly observed email address. The email address is extracted from across multiple message components, including HTML body templates and email header fields.↳ also matches headers (collection), headers.auth_summary
Suspicious mailer received from Gmail servers source low: Mailer is atypical of sends from Gmail infrastructure. Observed sending callback phishing and general spam.↳ also matches headers (collection), headers.return_path

Show 17 more (91 total) on the rules page

`headers.ips (collection)`

Description

Message Data Model attribute: headers.ips

Fields #

Name	Description
ip	The IP in canonical form

Detection Rules #

Full rule details for this event, including ATT&CK technique mappings and native queries →

Sublime MQL #

Observed IOC: Mail transiting OFAC-sanctioned bulletproof host Aeza Group source high: Detects inbound mail whose Received-header IP path transits IP space announced by Aeza Group LLC, a bulletproof hosting provider designated by the U.S. Treasury's Office of Foreign Assets Control (OFAC) on 2025-07-01 (CYBER4 / CAATSA-RUSSIA). IP ranges are the prefixes announced by Aeza's ASNs (AS210644, AS216246).↳ also matches headers (collection)
Observed IOC: Mail transiting bulletproof host - SmartApe source medium: Detects inbound mail whose IP space is announced by SmartApe (SmartApe LLC), a Russia-based hosting provider widely reported for abuse-tolerant / bulletproof hosting. IP ranges are the prefixes announced by SmartApe's ASN (AS56694).↳ also matches headers (collection)

`headers.reply_to (collection)`

Description

Message Data Model attribute: headers.reply_to

Fields #

Name	Description
display_name	Display name
email.domain
email.domain.domain	The fully qualified domain name (FQDN). This may not always be routable, e.g. when an email address contains a domain that is just a TLD with no SLD, e.g. foo@WIN-bar
email.domain.root_domain	The root domain, including the TLD
email.domain.tld	The domain's top-level domain. E.g. the TLD of google.com is 'com'
email.domain.valid	Whether the domain is valid
email.email	Full email address
email.local_part	Local-part, i.e. before the @

Common Indicators #

Field/value combinations most frequently checked by detection rules targeting this event, derived from cross-vendor predicate analysis.

Field	Kind	Value	Rules	Vendors
`headers.reply_to`	length_compare	`0`	31 rules	mql
`headers.auth_summary.dmarc.pass`	eq	`true`	12 rules	mql
`headers.auth_summary.spf.pass`	eq	`true`	12 rules	mql
`beta.profile.by_reply_to`	func_call	`beta.profile.by_reply_to().prevalence == new`	5 rules	mql
`network.whois`	func_call	`network.whois(sender.email.domain).days_old <= 30`	3 rules	mql
`sender.email.domain.root_domain`	eq	`docusign.net`	3 rules	mql
`sender.email.email`	eq	`no-reply@zoom.us`	3 rules	mql
`body.current_thread.text`	contains	`(kindly`	2 rules	mql
`body.current_thread.text`	contains	`anyone you know`	2 rules	mql
`body.current_thread.text`	contains	`downsizing`	2 rules	mql
`body.current_thread.text`	contains	`free donation`	2 rules	mql
`body.current_thread.text`	contains	`generously offering`	2 rules	mql
`body.current_thread.text`	contains	`if you will take it`	2 rules	mql
`body.current_thread.text`	contains	`indicate your interest`	2 rules	mql
`body.current_thread.text`	contains	`kindly`	2 rules	mql

Detection Rules #

Full rule details for this event, including ATT&CK technique mappings and native queries →

Sublime MQL #

Service abuse: DocSend share from newly registered domain source high: This Attack Surface Reduction (ASR) rule matches on DocSend notifications with recently registered reply-to domains.↳ also matches headers (collection), headers.auth_summary
Service abuse: DocuSign notification with suspicious sender or document name source medium: The detection rule is intended to match on messages sent from Docusign from a newly observed reply-to address which contains suspicious content within the document or sender display name.↳ also matches headers (collection), headers.auth_summary
Service abuse: DocuSign share from an unsolicited reply-to address source medium: DocuSign shares which contain a reply-to address or domain that has not been previously observed by the recipient organization.↳ also matches headers (collection), headers.auth_summary

Show 17 more (80 total) on the rules page

`headers.return_path`

Description

Message Data Model attribute: headers.return_path

Fields #

Name	Description
domain
domain.domain	The fully qualified domain name (FQDN). This may not always be routable, e.g. when an email address contains a domain that is just a TLD with no SLD, e.g. foo@WIN-bar
domain.root_domain	The root domain, including the TLD
domain.tld	The domain's top-level domain. E.g. the TLD of google.com is 'com'
email	Full email address
local_part	Local-part, i.e. before the @

Common Indicators #

Field/value combinations most frequently checked by detection rules targeting this event, derived from cross-vendor predicate analysis.

Field	Kind	Value	Rules	Vendors
`headers.return_path.domain.domain`	cross_field_compare	`sender.email.domain.domain`	2 rules	mql
`headers.return_path.domain.domain`	eq	`sendgrid.net`	3 rules	mql
`headers.return_path.domain.domain`	ne	`calendar-server.bounces.google.com`	2 rules	mql
`headers.auth_summary.spf.details.designator`	contains	`+srs=`	2 rules	mql
`headers.return_path.domain.root_domain`	eq	`salesforce.com`	2 rules	mql
`headers.return_path.domain.root_domain`	ne	`bestdeals.today`	2 rules	mql
`headers.return_path.email`	cross_field_compare	`sender.email.email`	2 rules	mql
`headers.return_path.email`	is_not_null		2 rules	mql
`headers.return_path.local_part`	contains	`+srs=`	2 rules	mql
`network.whois`	func_call	`network.whois(sender.email.domain).days_old <= 30`	2 rules	mql
`sender.email.domain.root_domain`	ne	`bestdeals.today`	2 rules	mql
`subject.subject`	regex_match	`remittance`	2 rules	mql
`subject.subject`	regex_match	`w2`	2 rules	mql
`beta.ocr(file.message_screenshot()).text`	contains	`best buy`	1 rule	mql
`beta.ocr(file.message_screenshot()).text`	contains	`ebay`	1 rule	mql

Detection Rules #

Full rule details for this event, including ATT&CK technique mappings and native queries →

Sublime MQL #

Service abuse: Task management message sent via SendGrid source medium: Detects messages impersonating task or productivity applications by using 'todo list' in the subject line or body while utilizing SendGrid infrastructure. The sender claims to be task-related through display name or body content but originates from non-legitimate domains without proper DMARC authentication.↳ also matches headers.auth_summary
Suspicious mailer received from Gmail servers source low: Mailer is atypical of sends from Gmail infrastructure. Observed sending callback phishing and general spam.↳ also matches headers (collection), headers.hops (collection)
Business Email Compromise (BEC) attempt from unsolicited sender source medium: Detects potential Business Email Compromise (BEC) attacks by analyzing text within the email body from unsolicited senders. ↳ also matches headers (collection), headers.auth_summary, headers.reply_to (collection)

Show 17 more (38 total) on the rules page

`headers.x_authenticated_domain`

Description

Message Data Model attribute: headers.x_authenticated_domain

Fields #

Name	Description
domain	The fully qualified domain name (FQDN). This may not always be routable, e.g. when an email address contains a domain that is just a TLD with no SLD, e.g. foo@WIN-bar

Detection Rules #

Full rule details for this event, including ATT&CK technique mappings and native queries →

Sublime MQL #

VIP impersonation with invoicing request source high: This rule detects emails attempting to impersonate a VIP, it leverages NLU to determine if there is invoicing verbiage in the current thread, and requires request language.↳ also matches headers (collection), headers.auth_summary, headers.reply_to (collection), headers.x_authenticated_sender

`headers.x_authenticated_sender`

Description

Message Data Model attribute: headers.x_authenticated_sender

Fields #

Name	Description
email	Full email address

Detection Rules #

Full rule details for this event, including ATT&CK technique mappings and native queries →

Sublime MQL #

VIP impersonation with invoicing request source high: This rule detects emails attempting to impersonate a VIP, it leverages NLU to determine if there is invoicing verbiage in the current thread, and requires request language.↳ also matches headers (collection), headers.auth_summary, headers.reply_to (collection), headers.x_authenticated_domain

`headers.x_originating_ip`

Description

Message Data Model attribute: headers.x_originating_ip

Fields #

Name	Description
ip	The IP in canonical form

Common Indicators #

Field/value combinations most frequently checked by detection rules targeting this event, derived from cross-vendor predicate analysis.

Field	Kind	Value	Rules	Vendors
`headers.mailer`	starts_with	`Open-Xchange Mailer`	1 rule	mql

Detection Rules #

Full rule details for this event, including ATT&CK technique mappings and native queries →

Sublime MQL #

BEC/Fraud: Urgent language and suspicious sending/infrastructure patterns source medium: Identifies inbound messages using urgent language patterns and sender behavioral traits common in social manipulation. Combines multiple indicators including urgent subject lines, characteristic message content, short message length, and suspicious sender attributes.↳ also matches headers (collection), headers.reply_to (collection)

References #

Sublime Message Data Model