Message Type

Attribute group	Sample	Rule
type	Y	Y

`type`

Description

Message Data Model attribute: type

Fields #

Name	Description	Rules
inbound	Message was sent from someone outside your organization, to at least one recipient inside your organization	3 detection rules
internal	Message was sent from someone inside your organization, to at least one recipient inside your organization. Messages must be authenticated by either SPF or DKIM to be treated as internal.
outbound	Message was sent from someone inside your organization, to at least one recipient outside your organization

Example Message Record #

{
  "type": {
    "inbound": true
  }
}

Common Indicators #

Positive field/value combinations most frequently checked by detection rules attached to this catalog entry, derived from cross-vendor predicate analysis. This is separate from Fields accounting, which also includes exclusions and counts distinct attached rules.

Field	Kind	Value	Rules	Vendors
`type.inbound`	eq	`true`	1212 rules	mql
`sender.email.domain.root_domain`	macro	`sender.email.domain.root_domain in high_trust_sender_root_domains`	297 rules	mql
`sender.email.domain.root_domain`	macro	`sender.email.domain.root_domain not in high_trust_sender_root_domains`	297 rules	mql
`sender.email.domain.root_domain`	macro	`sender.email.domain.root_domain in free_email_providers`	40 rules	mql
`profile.by_sender`	func_call	`profile.by_sender().any_messages_malicious_or_spam`	163 rules	mql
`profile.by_sender`	func_call	`profile.by_sender().prevalence in ("new", "outlier")`	49 rules	mql
`type.outbound`	eq	`true`	77 rules	mql
`recipients.to`	length_compare	`1`	70 rules	mql
`recipients.to`	length_compare	`0`	37 rules	mql
`body.links`	length_compare	`0`	68 rules	mql
`body.links`	length_compare	`10`	48 rules	mql
`attachments`	length_compare	`0`	62 rules	mql
`headers.in_reply_to`	is_null		45 rules	mql
`headers.references`	length_compare	`0`	44 rules	mql
`headers.auth_summary.dmarc.pass`	eq	`true`	39 rules	mql

Detection Rules #

Full rule details for this catalog entry, including ATT&CK technique mappings and native queries →

Sublime MQL #

Service abuse: Adobe Sign notification from an unsolicited reply-to address source medium: Identifies messages appearing to come from Adobe Sign signature notifications that contain a reply-to address not previously seen in organizational communications. This tactic exploits trust in legitimate Adobe services while attempting to establish unauthorized communication channels.
Service abuse: Amazon invitation with suspected callback phishing source medium: Detects Amazon's no-reply address with a subject about invitation sending, containing phone numbers within HTML header elements. This pattern is commonly used to trick recipients into calling fraudulent customer service numbers.
Service abuse: Behance document sharing with suspicious language source medium: Detects messages containing document sharing language with a single Behance gallery link, potentially indicating abuse of the legitimate Adobe Behance platform for malicious purposes.

Show 17 more (1289 total) on the rules page