Email Keywords ============== .. role:: example-rule-emphasis email.from ---------- Matches the MIME ``From`` field of an email. Comparison is case-sensitive. Syntax:: email.from; content:""; ``email.from`` is a 'sticky buffer' and can be used as a ``fast_pattern``. This keyword maps to the EVE field ``email.from`` Example ^^^^^^^ Example of a signature that would alert if a packet contains the MIME field ``from`` with the value ``toto `` .. container:: example-rule alert smtp any any -> any any (msg:"Test mime email from"; :example-rule-emphasis:`email.from; content:"toto ";` sid:1;) email.subject ------------- Matches the MIME ``Subject`` field of an email. Comparison is case-sensitive. Syntax:: email.subject; content:""; ``email.subject`` is a 'sticky buffer' and can be used as a ``fast_pattern``. This keyword maps to the EVE field ``email.subject`` Example ^^^^^^^ Example of a signature that would alert if a packet contains the MIME field ``subject`` with the value ``This is a test email`` .. container:: example-rule alert smtp any any -> any any (msg:"Test mime email subject"; :example-rule-emphasis:`email.subject; content:"This is a test email";` sid:1;) email.to -------- Matches the MIME ``To`` field of an email. Comparison is case-sensitive. Syntax:: email.to; content:""; ``email.to`` is a 'sticky buffer' and can be used as a ``fast_pattern``. This keyword maps to the EVE field ``email.to`` Example ^^^^^^^ Example of a signature that would alert if a packet contains the MIME field ``to`` with the value ``172.16.92.2@linuxbox`` .. container:: example-rule alert smtp any any -> any any (msg:"Test mime email to"; :example-rule-emphasis:`email.to; content:"172.16.92.2@linuxbox";` sid:1;) email.cc -------- Matches the MIME ``Cc`` field of an email. Comparison is case-sensitive. Syntax:: email.cc; content:""; ``email.cc`` is a 'sticky buffer' and can be used as a ``fast_pattern``. This keyword maps to the EVE field ``email.cc[]`` Example ^^^^^^^ Example of a signature that would alert if a packet contains the MIME field ``cc`` with the value ``Emily , Ava , Sophia Wilson `` .. container:: example-rule alert smtp any any -> any any (msg:"Test mime email cc"; :example-rule-emphasis:`email.cc; content:"Emily , Ava , Sophia Wilson ";` sid:1;) email.date ---------- Matches the MIME ``Date`` field of an email. Comparison is case-sensitive. Syntax:: email.date; content:""; ``email.date`` is a 'sticky buffer' and can be used as a ``fast_pattern``. This keyword maps to the EVE field ``email.date`` Example ^^^^^^^ Example of a signature that would alert if a packet contains the MIME field ``date`` with the value ``Fri, 21 Apr 2023 05:10:36 +0000`` .. container:: example-rule alert smtp any any -> any any (msg:"Test mime email date"; :example-rule-emphasis:`email.date; content:"Fri, 21 Apr 2023 05:10:36 +0000";` sid:1;) email.message_id ---------------- Matches the MIME ``Message-Id`` field of an email. Comparison is case-sensitive. Syntax:: email.message_id; content:""; ``email.message_id`` is a 'sticky buffer' and can be used as a ``fast_pattern``. This keyword maps to the EVE field ``email.message_id`` Example ^^^^^^^ Example of a signature that would alert if a packet contains the MIME field ``message id`` with the value ```` .. container:: example-rule alert smtp any any -> any any (msg:"Test mime email message id"; :example-rule-emphasis:`email.message_id; content:"";` sid:1;) email.x_mailer -------------- Matches the MIME ``X-Mailer`` field of an email. Comparison is case-sensitive. Syntax:: email.x_mailer; content:""; ``email.x_mailer`` is a 'sticky buffer' and can be used as a ``fast_pattern``. This keyword maps to the EVE field ``email.x_mailer`` Example ^^^^^^^ Example of a signature that would alert if a packet contains the MIME field ``x-mailer`` with the value ``Microsoft Office Outlook, Build 11.0.5510`` .. container:: example-rule alert smtp any any -> any any (msg:"Test mime email x-mailer"; :example-rule-emphasis:`email.x_mailer; content:"Microsoft Office Outlook, Build 11.0.5510";` sid:1;) email.url --------- Matches ``URL`` extracted of an email. Comparison is case-sensitive. Syntax:: email.url; content:""; ``email.url`` is a 'sticky buffer' and can be used as a ``fast_pattern``. ``email.url`` supports multiple buffer matching, see :doc:`multi-buffer-matching`. This keyword maps to the EVE field ``email.url[]`` Example ^^^^^^^ Example of a signature that would alert if an email contains the ``url`` ``test-site.org/blah/123/``. .. container:: example-rule alert smtp any any -> any any (msg:"Test mime email url"; :example-rule-emphasis:`email.url; content:"test-site.org/blah/123/";` sid:1;) email.received -------------- Matches ``Received`` field of an email. Comparison is case-sensitive. Syntax:: email.received; content:""; ``email.received`` is a 'sticky buffer' and can be used as a ``fast_pattern``. ``email.received`` supports multiple buffer matching, see :doc:`multi-buffer-matching`. This keyword maps to the EVE field ``email.received[]`` Example ^^^^^^^ Example of a signature that would alert if a packet contains the MIME field ``received`` with the value ``from [65.201.218.30] (helo=COZOXORY.club)by 173-66-46-112.wash.fios.verizon.net with esmtpa (Exim 4.86)(envelope-from )id 71cF63a9for mirjam@abrakadabra.ch; Mon, 29 Jul 2019 17:01:45 +0000`` .. container:: example-rule alert smtp any any -> any any (msg:"Test mime email received"; :example-rule-emphasis:`email.received; content:"from [65.201.218.30] (helo=COZOXORY.club)by 173-66-46-112.wash.fios.verizon.net with esmtpa (Exim 4.86)(envelope-from )id 71cF63a9for mirjam@abrakadabra.ch\; Mon, 29 Jul 2019 17:01:45 +0000";` sid:1;)