Message Mailbox

Attribute group	Rule
mailbox	Y
mailbox.email	Y

`mailbox`

Message Data Model attribute: mailbox

Name	Description
display_name	Display name
first_name	First name (given name) of the mailbox owner
last_name	Last name (surname) of the mailbox owner

Field/value combinations most frequently checked by detection rules targeting this event, derived from cross-vendor predicate analysis.

Field	Kind	Value	Rules	Vendors
`sender.display_name`	contains		2 rules	mql
`sender.display_name`	cross_field_compare	`mailbox.display_name`	3 rules	mql
`body.current_thread.text`	length_compare	`20`	1 rule	mql
`subject.base`	length_compare	`15`	1 rule	mql

Credential phishing: Suspicious e-sign agreement document notification source medium: Detects phishing attempts disguised as e-signature requests, characterized by common document sharing phrases, unusual HTML padding, and suspicious link text.
Credential phishing: Generic document share with unicode and proceedural greeting template source low: Detects messages that incorporate recipient-specific information (email domain, local part, domain elements or mailbox elements) alongside document-themed Unicode symbols and keywords. The rule identifies various targeting patterns including greeting-based personalization, attention-grabbing prefixes and multiple recipient elements. It also catches broken template attacks where recipient placeholders remain visible.
Employee impersonation: Payroll fraud source high: This rule detects messages impersonating employees, from unsolicited senders attempting to reroute payroll or alter payment details.

Message Data Model attribute: mailbox.email

Name	Description
domain.sld	Second-level domain, e.g. 'windows' for the domain 'windows.net'
email	Full email address
local_part	Local-part, i.e. before the @

Field/value combinations most frequently checked by detection rules targeting this event, derived from cross-vendor predicate analysis.

Field	Kind	Value	Rules	Vendors
`mailbox.email.domain.sld`	length_compare	`4`	2 rules	mql

Inbound message from popular service via newly observed distribution list source medium: Detects when a message comes through a distribution list by matching on return paths containing Sender Rewrite Scheme (SRS) from a previously unknown domain sender to a single recipient who has never interacted with the organization. This method has been observed being abused by threat actors to deliver callback phishing.
Display name impersonation using recipient SLD source medium: The recipient domain's SLD is used in the sender's display name in order to impersonate the organization.
Display name and subject impersonation using recipient SLD (new sender) source medium: The recipient domain's SLD is used in the sender's display name and in the subject to impersonate the organization.