Sender: Suspicious CC suffix in sender display name

Detects inbound messages where the sender's display name ends with a 'cc:' or 'CC:' suffix, a tactic often used to appear as though they're recipients rather than part of the attacker's sender identity.