Message Type

Attribute group	Rule
type	Y

`type`

Message Data Model attribute: type

Name	Description
inbound	Message was sent from someone outside your organization, to at least one recipient inside your organization
internal	Message was sent from someone inside your organization, to at least one recipient inside your organization. Messages must be authenticated by either SPF or DKIM to be treated as internal.
outbound	Message was sent from someone inside your organization, to at least one recipient outside your organization

Field/value combinations most frequently checked by detection rules targeting this event, derived from cross-vendor predicate analysis.

Field	Kind	Value	Rules	Vendors
`type.inbound`	eq	`true`	1158 rules	mql
`profile.by_sender`	func_call	`profile.by_sender().any_messages_malicious_or_spam`	165 rules	mql
`profile.by_sender`	func_call	`profile.by_sender().prevalence in (new, outlier)`	50 rules	mql
`type.outbound`	eq	`true`	162 rules	mql
`attachments`	length_compare	`0`	85 rules	mql
`attachments`	length_compare	`1`	31 rules	mql
`body.links`	length_compare	`0`	85 rules	mql
`body.links`	length_compare	`10`	49 rules	mql
`recipients.to`	length_compare	`1`	71 rules	mql
`recipients.to`	length_compare	`0`	38 rules	mql
`headers.references`	length_compare	`0`	46 rules	mql
`headers.in_reply_to`	is_null		45 rules	mql
`headers.auth_summary.dmarc.pass`	eq	`true`	36 rules	mql
`headers.auth_summary.spf.pass`	eq	`true`	32 rules	mql
`headers.reply_to`	length_compare	`0`	30 rules	mql

Service abuse: Adobe Sign notification from an unsolicited reply-to address source medium: Identifies messages appearing to come from Adobe Sign signature notifications that contain a reply-to address not previously seen in organizational communications. This tactic exploits trust in legitimate Adobe services while attempting to establish unauthorized communication channels.
Service abuse: Amazon invitation with suspected callback phishing source medium: Detects Amazon's no-reply address with a subject about invitation sending, containing phone numbers within HTML header elements. This pattern is commonly used to trick recipients into calling fraudulent customer service numbers.
Service abuse: Behance document sharing with suspicious language source medium: Detects messages containing document sharing language with a single Behance gallery link, potentially indicating abuse of the legitimate Adobe Behance platform for malicious purposes.