Message Subject

Attribute group	Sample	Rule
subject	Y	Y

`subject`

Description

Message Data Model attribute: subject

Fields #

Name	Description
base	Subject of the email with tags and reply/forward indicators removed
is_forward	Indicates if the subject of the email is a forward
is_reply	Indicates if the subject of the email is a reply
subject	Subject of the email

Example Message Record #

{
  "subject": {
    "subject": "A file was shared with you tyrellcorp-Covid-19 Vaccination And Testing Report.pdf."
  }
}

Common Indicators #

Positive field/value combinations most frequently checked by detection rules attached to this catalog entry, derived from cross-vendor predicate analysis. This is separate from Fields accounting, which also includes exclusions and counts distinct attached rules.

Field	Kind	Value	Rules	Vendors
`type.inbound`	eq	`true`	292 rules	mql
`type.outbound`	eq	`true`	77 rules	mql
`attachments`	length_compare	`0`	37 rules	mql
`attachments`	length_compare	`0`	15 rules	mql
`attachments`	length_compare	`1`	12 rules	mql
`headers.in_reply_to`	is_null		31 rules	mql
`headers.references`	length_compare	`0`	30 rules	mql
`body.links`	length_compare	`0`	27 rules	mql
`sender.email.domain.root_domain`	macro	`sender.email.domain.root_domain in free_email_providers`	20 rules	mql
`profile.by_sender`	func_call	`profile.by_sender().prevalence in ("new", "outlier")`	17 rules	mql
`headers.auth_summary.dmarc.pass`	eq	`true`	15 rules	mql
`headers.reply_to`	length_compare	`0`	15 rules	mql
`body.previous_threads`	length_compare	`0`	14 rules	mql
`headers.auth_summary.spf.pass`	eq	`true`	14 rules	mql
`subject.subject`	contains	`shared`	12 rules	mql

Detection Rules #

Full rule details for this catalog entry, including ATT&CK technique mappings and native queries →

Sublime MQL #

Service abuse: Adobe Sign notification from an unsolicited reply-to address source medium: Identifies messages appearing to come from Adobe Sign signature notifications that contain a reply-to address not previously seen in organizational communications. This tactic exploits trust in legitimate Adobe services while attempting to establish unauthorized communication channels.
Service abuse: Amazon invitation with suspected callback phishing source medium: Detects Amazon's no-reply address with a subject about invitation sending, containing phone numbers within HTML header elements. This pattern is commonly used to trick recipients into calling fraudulent customer service numbers.
Service Abuse: Box file sharing with credential phishing intent source medium: Detects abuse of Box's legitimate infrastructure for credential phishing attacks.

Show 17 more (369 total) on the rules page