Message Subject

Attribute group	Rule
subject	Y

`subject`

Message Data Model attribute: subject

Name	Description
base	Subject of the email with tags and reply/forward indicators removed
is_forward	Indicates if the subject of the email is a forward
is_reply	Indicates if the subject of the email is a reply
subject	Subject of the email

Field/value combinations most frequently checked by detection rules targeting this event, derived from cross-vendor predicate analysis.

Field	Kind	Value	Rules	Vendors
`type.inbound`	eq	`true`	282 rules	mql
`type.outbound`	eq	`true`	149 rules	mql
`attachments`	length_compare	`0`	47 rules	mql
`attachments`	length_compare	`1`	14 rules	mql
`body.links`	length_compare	`0`	39 rules	mql
`headers.in_reply_to`	is_null		31 rules	mql
`headers.references`	length_compare	`0`	31 rules	mql
`profile.by_sender`	func_call	`profile.by_sender().prevalence in (new, outlier)`	17 rules	mql
`headers.reply_to`	length_compare	`0`	16 rules	mql
`body.current_thread.text`	contains	`subscription`	15 rules	mql
`body.current_thread.text`	contains	`antivirus`	13 rules	mql
`body.current_thread.text`	contains	`cancel`	13 rules	mql
`body.previous_threads`	length_compare	`0`	15 rules	mql
`headers.auth_summary.dmarc.pass`	eq	`true`	15 rules	mql
`headers.auth_summary.spf.pass`	eq	`true`	14 rules	mql

Service abuse: Adobe Sign notification from an unsolicited reply-to address source medium: Identifies messages appearing to come from Adobe Sign signature notifications that contain a reply-to address not previously seen in organizational communications. This tactic exploits trust in legitimate Adobe services while attempting to establish unauthorized communication channels.
Service abuse: Amazon invitation with suspected callback phishing source medium: Detects Amazon's no-reply address with a subject about invitation sending, containing phone numbers within HTML header elements. This pattern is commonly used to trick recipients into calling fraudulent customer service numbers.
Service Abuse: Box file sharing with credential phishing intent source medium: Detects abuse of Box's legitimate infrastructure for credential phishing attacks.