Sender: Local part built from recipient domain and mailbox

calendar Aug 20, 2026 · Attack surface reduction  ·
Share on: linkedin copy

Flags inbound messages where the sender's local part is constructed by combining the recipient's domain name and mailbox name (e.g., domain_mailbox). This pattern is commonly used to make the sender address appear related to or originating from the recipient's own organization, helping the message blend in and evade scrutiny.

Sublime rule (View on GitHub)

 1name: "Sender: Local part built from recipient domain and mailbox"
 2description: "Flags inbound messages where the sender's local part is constructed by combining the recipient's domain name and mailbox name (e.g., domain_mailbox). This pattern is commonly used to make the sender address appear related to or originating from the recipient's own organization, helping the message blend in and evade scrutiny."
 3type: "rule"
 4severity: "low"
 5source: |
 6  type.inbound
 7  and sender.email.local_part == strings.concat(recipients.to[0].email.domain.sld,
 8                                                '_',
 9                                                recipients.to[0].email.local_part
10  )
11  and sender.email.domain.root_domain != recipients.to[0].email.domain.root_domain  
12tags:
13  - "Attack surface reduction"
14attack_types:
15  - "BEC/Fraud"
16  - "Credential Phishing"
17tactics_and_techniques:
18  - "Spoofing"
19  - "Evasion"
20  - "Impersonation: Employee"
21detection_methods:
22  - "Header analysis"
23  - "Sender analysis"
24id: "fce2ba42-17a2-5b84-8760-0a5e641f0bb8"

Related rules

to-top