Message Sender

Attribute group	Rule
sender	Y
sender.email	Y

`sender`

Message Data Model attribute: sender

Name	Description
display_name	Display name

Field/value combinations most frequently checked by detection rules targeting this event, derived from cross-vendor predicate analysis.

Field	Kind	Value	Rules	Vendors
`headers.reply_to`	length_compare	`0`	12 rules	mql
`beta.ocr`	func_call	`beta.ocr(file.message_screenshot()).text !=`	7 rules	mql
`subject.subject`	regex_match	`termination.*notice`	7 rules	mql
`subject.subject`	regex_match	`38417`	6 rules	mql
`subject.subject`	regex_match	`:completed`	6 rules	mql
`subject.subject`	regex_match	`[il1]{2}mit.*ma[il1]{2} ?bo?x`	6 rules	mql
`subject.subject`	regex_match	`[il][il][il]egai[ -]`	6 rules	mql
`subject.subject`	regex_match	`[li][li][li]ega[li] attempt`	6 rules	mql
`subject.subject`	regex_match	`[ng]-?[io]n .*block`	6 rules	mql
`subject.subject`	regex_match	`[ng]-?[io]n .*cancel`	6 rules	mql
`subject.subject`	regex_match	`[ng]-?[io]n .*deactiv`	6 rules	mql
`subject.subject`	regex_match	`[ng]-?[io]n .*disabl`	6 rules	mql
`subject.subject`	regex_match	`abandon.*package`	6 rules	mql
`subject.subject`	regex_match	`about.your.account`	6 rules	mql
`subject.subject`	regex_match	`acc(ou)?n?t (is )?on ho[li]d`	6 rules	mql

Service abuse: DocuSign notification with suspicious sender or document name source medium: The detection rule is intended to match on messages sent from Docusign from a newly observed reply-to address which contains suspicious content within the document or sender display name.↳ also matches sender.email
Service Abuse: ExactTarget with suspicious sender indicators source high: Message originates from ExactTarget infrastructure but uses a suspicious sender domain, including overly long salesforce.com domains, awsapps.com domains, domains containing UTF-8 encoding characters, or a suspicious sender display name.↳ also matches sender.email
Service Abuse: HelloSign share with suspicious sender or document name source medium: The detection rule is designed to identify messages sent from HelloSign that notify recipients about a shared file and contain suspicious content either in the document or the sender's display name.↳ also matches sender.email

Message Data Model attribute: sender.email

Name	Description
domain
domain.domain	The fully qualified domain name (FQDN). This may not always be routable, e.g. when an email address contains a domain that is just a TLD with no SLD, e.g. foo@WIN-bar
domain.root_domain	The root domain, including the TLD
domain.sld	Second-level domain, e.g. 'windows' for the domain 'windows.net'
domain.subdomain	Subdomain, e.g. 'drive' for the domain 'drive.google.com'
domain.tld	The domain's top-level domain. E.g. the TLD of google.com is 'com'
domain.valid	Whether the domain is valid
email	Full email address
local_part	Local-part, i.e. before the @

Field/value combinations most frequently checked by detection rules targeting this event, derived from cross-vendor predicate analysis.

Field	Kind	Value	Rules	Vendors
`type.inbound`	eq	`true`	733 rules	mql
`profile.by_sender`	func_call	`profile.by_sender().any_messages_malicious_or_spam`	125 rules	mql
`profile.by_sender`	func_call	`profile.by_sender().prevalence in (new, outlier)`	35 rules	mql
`attachments`	length_compare	`0`	71 rules	mql
`body.links`	length_compare	`0`	65 rules	mql
`body.links`	length_compare	`10`	39 rules	mql
`recipients.to`	length_compare	`1`	51 rules	mql
`recipients.to`	length_compare	`0`	36 rules	mql
`headers.references`	length_compare	`0`	40 rules	mql
`headers.in_reply_to`	is_null		39 rules	mql
`type.outbound`	eq	`true`	39 rules	mql
`headers.auth_summary.dmarc.pass`	eq	`true`	35 rules	mql
`headers.auth_summary.spf.pass`	eq	`true`	31 rules	mql
`headers.reply_to`	length_compare	`0`	30 rules	mql
`recipients.cc`	length_compare	`0`	24 rules	mql

Service abuse: Adobe Sign notification from an unsolicited reply-to address source medium: Identifies messages appearing to come from Adobe Sign signature notifications that contain a reply-to address not previously seen in organizational communications. This tactic exploits trust in legitimate Adobe services while attempting to establish unauthorized communication channels.
Service abuse: Amazon invitation with suspected callback phishing source medium: Detects Amazon's no-reply address with a subject about invitation sending, containing phone numbers within HTML header elements. This pattern is commonly used to trick recipients into calling fraudulent customer service numbers.
Service abuse: Behance document sharing with suspicious language source medium: Detects messages containing document sharing language with a single Behance gallery link, potentially indicating abuse of the legitimate Adobe Behance platform for malicious purposes.