Message Mailbox

Attribute group	Sample	Rule
mailbox	N	Y
mailbox.email	N	Y

`mailbox`

Description

Message Data Model attribute: mailbox

Fields #

Name	Description
display_name	Display name
first_name	First name (given name) of the mailbox owner
last_name	Last name (surname) of the mailbox owner

Common Indicators #

Positive field/value combinations most frequently checked by detection rules attached to this catalog entry, derived from cross-vendor predicate analysis. This is separate from Fields accounting, which also includes exclusions and counts distinct attached rules.

Field	Kind	Value	Rules	Vendors
`recipients.to`	length_compare	`0`	3 rules	mql
`sender.display_name`	contains		2 rules	mql
`sender.display_name`	macro	`sender.display_name in org_display_names`	2 rules	mql
`body.current_thread.links`	length_compare	`0`	1 rule	mql
`subject.base`	length_compare	`15`	1 rule	mql
`subject.base`	macro	`subject.base in org_display_names`	1 rule	mql

Detection Rules #

Full rule details for this catalog entry, including ATT&CK technique mappings and native queries →

Sublime MQL #

Credential phishing: Suspicious e-sign agreement document notification source medium: Detects phishing attempts disguised as e-signature requests, characterized by common document sharing phrases, unusual HTML padding, and suspicious link text.
Credential phishing: Generic document share with unicode and proceedural greeting template source low: Detects messages that incorporate recipient-specific information (email domain, local part, domain elements or mailbox elements) alongside document-themed Unicode symbols and keywords. The rule identifies various targeting patterns including greeting-based personalization, attention-grabbing prefixes and multiple recipient elements. It also catches broken template attacks where recipient placeholders remain visible.
Employee impersonation: Payroll fraud source high: This rule detects messages impersonating employees, from unsolicited senders attempting to reroute payroll or alter payment details.

Show 6 more (9 total) on the rules page

`mailbox.email`

Description

Message Data Model attribute: mailbox.email

Fields #

Name	Description
domain.sld	Second-level domain, e.g. 'windows' for the domain 'windows.net'
email	Full email address
local_part	Local-part, i.e. before the @

Common Indicators #

Field	Kind	Value	Rules	Vendors
`length`	func_call	`length(filter(attachments, .file_type not in $file_types_images)) > 0`	2 rules	mql
`mailbox.email.domain.sld`	length_compare	`4`	2 rules	mql
`strings.icontains`	func_call	`strings.icontains(sender.display_name, mailbox.email.domain.sld)`	2 rules	mql

Detection Rules #

Full rule details for this catalog entry, including ATT&CK technique mappings and native queries →

Sublime MQL #

Inbound message from popular service via newly observed distribution list source medium: Detects when a message comes through a distribution list by matching on return paths containing Sender Rewrite Scheme (SRS) from a previously unknown domain sender to a single recipient who has never interacted with the organization. This method has been observed being abused by threat actors to deliver callback phishing.
Display name impersonation using recipient SLD source medium: The recipient domain's SLD is used in the sender's display name in order to impersonate the organization.
Display name and subject impersonation using recipient SLD (new sender) source medium: The recipient domain's SLD is used in the sender's display name and in the subject to impersonate the organization.

Show 1 more (4 total) on the rules page

References #

Sublime Message Data Model