CybOX_Simple_Email_Pattern.xml

<?xml version="1.0" encoding="UTF-8"?>
<cybox:Observables 
    xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" 
    xmlns:cybox="http://docs.oasis-open.org/cti/ns/cybox/core-2" 
    xmlns:cyboxCommon="http://docs.oasis-open.org/cti/ns/cybox/common-2" 
    xmlns:AddrObj="http://docs.oasis-open.org/cti/ns/cybox/objects/address-2" 
    xmlns:URIObj="http://docs.oasis-open.org/cti/ns/cybox/objects/uri-2" 
    xmlns:FileObj="http://docs.oasis-open.org/cti/ns/cybox/objects/file-2" 
    xmlns:cyboxVocabs="http://docs.oasis-open.org/cti/ns/cybox/vocabularies-2" 
    xmlns:EmailMessageObj="http://docs.oasis-open.org/cti/ns/cybox/objects/email-message-2" 
    xmlns:example="http://example.com/" 
    xsi:schemaLocation="
    http://docs.oasis-open.org/cti/ns/cybox/core-2 ../core.xsd
    http://docs.oasis-open.org/cti/ns/cybox/objects/file-2 ../objects/File_Object.xsd
    http://docs.oasis-open.org/cti/ns/cybox/objects/email-message-2 ../objects/Email_Message_Object.xsd
    http://docs.oasis-open.org/cti/ns/cybox/vocabularies-2 ../default_vocabularies.xsd" 
    cybox_major_version="2" cybox_minor_version="1" cybox_update_version="1">
    <cybox:Observable id="example:Obervable-298376a2-cf65-4778-9894-ed9a95b5441d">
        <cybox:Object id="example:Object-f9769431-db6b-448f-b34e-72eb3c3e07d1">
            <cybox:Properties xsi:type="EmailMessageObj:EmailMessageObjectType">
                <EmailMessageObj:Header>
                    <EmailMessageObj:From category="e-mail">
                        <AddrObj:Address_Value condition="Equals" apply_condition="ANY">attacker@example.com##comma##attacker1@example.com##comma##attacker@bad.example.com</AddrObj:Address_Value>
                    </EmailMessageObj:From>
                    <EmailMessageObj:Subject condition="Equals" >New modifications to the specification</EmailMessageObj:Subject>
                </EmailMessageObj:Header>
            </cybox:Properties>
        </cybox:Object>
    </cybox:Observable>
</cybox:Observables>