Users that Received Malicious Emails (Prevented Attacks)

Description

In the main Cyber Attack View, in the Prevented Attacks section, double-click Users that Received Malicious Emails.

Note - Select the report period in the top left corner of this view. For example, Last 7 Days, This Month, and so on.

The email vector is the common vector used to deliver a malicious payload.

This drill-down view shows a summary of email attack attempts.

The IPSClosed Check Point Software Blade on a Security Gateway that inspects and analyzes packets and data for numerous types of risks (Intrusion Prevention System)., Anti-VirusClosed Check Point Software Blade on a Security Gateway that uses real-time virus signatures and anomaly-based protections from ThreatCloud to detect and block malware at the Security Gateway before users are affected. Acronym: AV., Threat EmulationClosed Check Point Software Blade on a Security Gateway that monitors the behavior of files in a sandbox to determine whether or not they are malicious. Acronym: TE. and Threat ExtractionClosed Check Point Software Blade on a Security Gateway that removes malicious content from files. Acronym: TEX.Software Blades work in parallel to determine if an email is malicious and provide multi-layer protection.

Drill-Down View

This is an obfuscated example of the drill-down view:

To see the applicable logs (the next drill-down level), double-click a value.

Available Widgets

Widgets available in the drill-down view:

Widget

Type

Description

Malicious Emails

Infographic

Shows the total number of emails with content that the Security GatewayClosed Dedicated Check Point server that runs Check Point software to inspect traffic and enforce Security Policies for connected network resources. found as malicious.

Top 10 Email Protection Types

Chart

Shows top Check Point protections that found malicious emails.

Shows:

  • The names of the top protections on (from all the Software Blades) that found malicious emails.

  • The number of malicious emails the top protections found.

Different colors show different protection types.

Top Targeted Recipients

Chart

Shows the recipients of malicious emails sorted by the number of emails they received.

Shows:

  • Users, who received the largest number of malicious emails.

  • The number of malicious emails they received.

Different colors show different recipients.

Top Malicious Senders

Chart

Shows the senders of malicious emails sorted by the number of emails they sent.

Shows:

  • Users, who sent the largest number of malicious emails.

  • The number of malicious emails they sent.

Different colors show different senders.

Detected Malicious Emails

Table

Shows malicious emails.

Shows this information about the detected malicious emails:

  • From

  • To

  • Subject

  • File Name

  • File Size

  • File MD5

  • Protection Name

Timeline of Email Campaigns (Top 10 Protections)

Timeline

Shows the number of detected malicious emails and their timeline.

The timeline is divided into different protection types.

Different colors show different campaigns.

Widget Query

In addition to the Default Query, the widget runs this query:

Calculated Service > Equals > SMTP

Custom Filter = ((blade:ips AND ("Adobe Reader Violation" OR "Content Protection Violation" OR "Mail Content Protection Violation" OR "SMTP Protection Violation" OR "Phishing Enforcement Protection" OR "Adobe Flash Protection Violation")) OR (blade:"Threat Emulation") OR (blade:Anti-Virus ) OR (blade:"Threat Extraction" AND content_risk ("Medium" OR "High" OR "Critical"))) AND service:("pop3" OR "smtp" OR "imap")

Best Practices

Best practices against malicious emails:

  • Examine the Timeline of Email Campaigns (Top 10 Protections) to see email attack trends against your organization.

  • To fine-tune your email protection policy, examine the Top 10 Email Protection Types to see the top attack types.

    For example, if you see that the top protection that detected malicious emails is Malicious archive file, you need to decide if your Security PolicyClosed Collection of rules that control network traffic and enforce organization guidelines for data protection and access to resources with packet inspection. needs to allow archives in emails.

    If you need to allow archives in emails, change your policy accordingly to prevent malicious files and not detect them. This includes enabling more Software Blades, if needed (such as Threat Emulationand Threat Extraction).

  • Examine the Top Targeted Recipients to understand:

    • Why are these internal email addresses exposed outside of your organization?

    • Should these internal email addresses be known outside of your organization from a business perspective?

Malicious Emails Video