Message Recipients

Attribute group	Rule
recipients	Y
recipients.bcc (collection)	Y
recipients.cc (collection)	Y
recipients.to (collection)	Y

`recipients`

Description

Message Data Model attribute: recipients

Fields #

Name	Description
bcc	List of 'bcc' Mailbox objects
cc	List of 'cc' Mailbox objects
to	List of 'to' Mailbox objects

Common Indicators #

Field/value combinations most frequently checked by detection rules targeting this event, derived from cross-vendor predicate analysis.

Field	Kind	Value	Rules	Vendors
`recipients.to`	length_compare	`1`	71 rules	mql
`recipients.to`	length_compare	`0`	40 rules	mql
`recipients.cc`	length_compare	`0`	27 rules	mql
`recipients.bcc`	length_compare	`0`	24 rules	mql
`sender.email.email`	cross_field_compare	`recipients.to[0].email.email`	20 rules	mql
`profile.by_sender_email`	func_call	`profile.by_sender_email().any_messages_malicious_or_spam`	14 rules	mql
`profile.by_sender_email`	func_call	`profile.by_sender_email().prevalence == new`	8 rules	mql
`profile.by_sender_email`	func_call	`profile.by_sender_email().prevalence in (new, outlier)`	7 rules	mql
`body.links`	length_compare	`10`	13 rules	mql
`recipients.to[0].email.domain.valid`	eq	`true`	13 rules	mql
`recipients.to[0].email.domain.valid`	eq	`false`	9 rules	mql
`attachments`	length_compare	`1`	12 rules	mql
`body.current_thread.text`	is_null		9 rules	mql
`body.current_thread.links`	length_compare	`0`	6 rules	mql
`body.current_thread.links`	length_compare	`10`	6 rules	mql

Detection Rules #

Full rule details for this event, including ATT&CK technique mappings and native queries →

Sublime MQL #

Abuse: Cloudflare Workers Hosted EvilTokens Domain Structure source high: Detects messages containing links to Cloudflare Workers domains that follow naming patterns designed to impersonate legitimate services such as Adobe, DocuSign, OneDrive, SharePoint, and voicemail systems. These domains use suspicious alphanumeric identifiers and may be used to deceive recipients into believing they are accessing trusted services.↳ also matches recipients.to (collection)
Attachment: Adobe image lure in body or attachment with suspicious link source medium: Detects Adobe phishing messages with an Adobe logo in the body or attachment, with suspicious link language.↳ also matches recipients.cc (collection), recipients.to (collection)
Brand impersonation: Adobe (QR code) source high: Detects messages using Adobe image based lures, referencing or including a QR code from an Unsolicited sender. These messages often lead users to phishing sites or initiate unwanted downloads.↳ also matches recipients.to (collection)

Show 17 more (186 total) on the rules page

`recipients.bcc (collection)`

Description

Message Data Model attribute: recipients.bcc

Fields #

Name	Description
display_name	Display name
email.domain.root_domain	The root domain, including the TLD
email.local_part	Local-part, i.e. before the @

Common Indicators #

Field/value combinations most frequently checked by detection rules targeting this event, derived from cross-vendor predicate analysis.

Field	Kind	Value	Rules	Vendors
`body.current_thread.text`	length_compare	`20`	1 rule	mql
`type.outbound`	eq	`true`	1 rule	mql

Detection Rules #

Full rule details for this event, including ATT&CK technique mappings and native queries →

Sublime MQL #

Credential phishing: Generic document share with unicode and proceedural greeting template source low: Detects messages that incorporate recipient-specific information (email domain, local part, domain elements or mailbox elements) alongside document-themed Unicode symbols and keywords. The rule identifies various targeting patterns including greeting-based personalization, attention-grabbing prefixes and multiple recipient elements. It also catches broken template attacks where recipient placeholders remain visible.↳ also matches recipients, recipients.to (collection)
Reconnaissance: Short generic greeting message source medium: Detects potential reconnaissance messages with very short, generic content like 'Hi' or 'Hello' from external senders. These messages are often used to validate email addresses and test deliverability before launching larger attacks. ↳ also matches recipients, recipients.cc (collection), recipients.to (collection)
DLP - Outbound to Personal Email Domains source medium: Detects outbound emails routed to free or disposable personal email providers when accompanied by at least one amplifying signal: any file attachment, a recipient display name matching an internal org mailbox (misdirection via $org_mailboxes), or a recipient local part resembling the sender's own address (self-exfiltration signal, levenshtein distance <= 2). No ml_extract applicable. Signals are domain routing and address similarity, not structured sensitive data patterns. Sensitive language keyword matching omitted to reduce FPs. Pair with the sensitive work product rule for content-specific escalation. ↳ also matches recipients, recipients.cc (collection), recipients.to (collection)

`recipients.cc (collection)`

Description

Message Data Model attribute: recipients.cc

Fields #

Name	Description
display_name	Display name
email.domain.domain	The fully qualified domain name (FQDN). This may not always be routable, e.g. when an email address contains a domain that is just a TLD with no SLD, e.g. foo@WIN-bar
email.domain.root_domain	The root domain, including the TLD
email.domain.valid	Whether the domain is valid
email.email	Full email address
email.local_part	Local-part, i.e. before the @

Common Indicators #

Field/value combinations most frequently checked by detection rules targeting this event, derived from cross-vendor predicate analysis.

Field	Kind	Value	Rules	Vendors
`recipients.cc`	length_compare	`1`	4 rules	mql
`body.current_thread.text`	contains	`kindly`	1 rule	mql
`type.outbound`	eq	`true`	1 rule	mql

Detection Rules #

Full rule details for this event, including ATT&CK technique mappings and native queries →

Sublime MQL #

Attachment: Adobe image lure in body or attachment with suspicious link source medium: Detects Adobe phishing messages with an Adobe logo in the body or attachment, with suspicious link language.↳ also matches recipients, recipients.to (collection)
Attachment: Encrypted PDF with credential theft language in EML source medium: Attached PDF is encrypted, and email body contains credential theft language, wrapped in an attached .eml file. Seen in-the-wild impersonating e-fax services.↳ also matches recipients, recipients.to (collection)
Attachment: QR code with userinfo portion source high: Detects inbound messages that contain image or document attachments with QR codes containing embedded usernames, passwords, or excessively padded URLs. This technique is used to bypass traditional text-based detection methods.↳ also matches recipients, recipients.to (collection)

Show 14 more (17 total) on the rules page

`recipients.to (collection)`

Description

Message Data Model attribute: recipients.to

Fields #

Name	Description
display_name	Display name
email.domain
email.domain.domain	The fully qualified domain name (FQDN). This may not always be routable, e.g. when an email address contains a domain that is just a TLD with no SLD, e.g. foo@WIN-bar
email.domain.root_domain	The root domain, including the TLD
email.domain.sld	Second-level domain, e.g. 'windows' for the domain 'windows.net'
email.domain.valid	Whether the domain is valid
email.email	Full email address
email.local_part	Local-part, i.e. before the @

Common Indicators #

Field/value combinations most frequently checked by detection rules targeting this event, derived from cross-vendor predicate analysis.

Field	Kind	Value	Rules	Vendors
`recipients.to`	length_compare	`1`	65 rules	mql
`recipients.to`	length_compare	`0`	35 rules	mql
`recipients.cc`	length_compare	`0`	24 rules	mql
`recipients.bcc`	length_compare	`0`	23 rules	mql
`sender.email.email`	cross_field_compare	`recipients.to[0].email.email`	20 rules	mql
`recipients.to[0].email.domain.valid`	eq	`true`	14 rules	mql
`recipients.to[0].email.domain.valid`	eq	`false`	9 rules	mql
`profile.by_sender_email`	func_call	`profile.by_sender_email().any_messages_malicious_or_spam`	12 rules	mql
`profile.by_sender_email`	func_call	`profile.by_sender_email().prevalence == new`	8 rules	mql
`attachments`	length_compare	`1`	11 rules	mql
`body.current_thread.links`	length_compare	`0`	6 rules	mql
`body.current_thread.links`	length_compare	`10`	5 rules	mql
`recipients.to[0].email.email`	cross_field_compare	`sender.email.email`	6 rules	mql
`body.links`	length_compare	`15`	5 rules	mql
`body.links`	length_compare	`1`	4 rules	mql

Detection Rules #

Full rule details for this event, including ATT&CK technique mappings and native queries →

Sublime MQL #

Abuse: Cloudflare Workers Hosted EvilTokens Domain Structure source high: Detects messages containing links to Cloudflare Workers domains that follow naming patterns designed to impersonate legitimate services such as Adobe, DocuSign, OneDrive, SharePoint, and voicemail systems. These domains use suspicious alphanumeric identifiers and may be used to deceive recipients into believing they are accessing trusted services.↳ also matches recipients
Attachment: Adobe image lure in body or attachment with suspicious link source medium: Detects Adobe phishing messages with an Adobe logo in the body or attachment, with suspicious link language.↳ also matches recipients, recipients.cc (collection)
Brand impersonation: Adobe (QR code) source high: Detects messages using Adobe image based lures, referencing or including a QR code from an Unsolicited sender. These messages often lead users to phishing sites or initiate unwanted downloads.↳ also matches recipients

Show 17 more (183 total) on the rules page

References #

Sublime Message Data Model