Email Security Cloud Integrated - Attachment Protect Insight

This article provides an overview of Attachment Protect for Email Security Cloud Integrated.

Your email attachments undergo a robust, multi-layered security process that is designed to protect you from potential threats like malware, ransomware, and phishing attacks. 

Below is a breakdown of the steps involved in the Attachment Protect process:

1. Macros and Dangerous File Types: This stage involves identifying and blocking embedded macros and risky file formats.
2. First Antivirus Checks: This stage involves performing a quick, initial antivirus scan.
3. Second Antivirus Checks: This stage involves more in-depth scanning using multiple antivirus tools.
4. Static File Analysis (Prefiltering): The fourth stage in the process examines file structure, code, and embedded content for signs of threats.
5. Sandboxing: The fifth stage involves behavioral analysis in a secure virtual environment to catch advanced threats.
6. Final Decision: At this point, files are either delivered securely, or, blocked as unsafe. 

The stages above take place in a funnel-style process and are linked to policy specificity. For more information on this, see the Policies Video on the Configure - Email Security Cloud Integrated page. 

Initial Check: Macros and Dangerous File Types

Attachments are scanned for macros, which are small programs embedded in files like Microsoft Word or Excel documents. Malicious macros are often used to execute harmful actions such as downloading malware or altering system settings. Additionally, the system identifies and blocks dangerous file types such as executables (.exe) or script files that pose a higher security risk. 

This stage filters out attachments that are immediately identifiable as harmful, preventing unnecessary processing at deeper stages.

Stage One Antivirus Checks

• This stage involves a proprietary antivirus system that performs a swift initial scan using advanced algorithms to detect common threats.

Stage Two Antivirus Checks

• Attachments are analyzed using multiple, industry-leading , AI-powered antivirus engines to ensure a broad spectrum of malware detection.
• This multi-engine approach ensures greater accuracy and reduces the chances of missing known malware signatures.

Static File Analysis (Prefiltering) 

• In this stage, the attachment undergoes a deeper static analysis without being executed.
• The system examines the file’s structure, code, and embedded content for anomalies or links to malicious websites.
• Prefiltering is equivalent to static file analysis and includes heuristic checks for threats that may not yet be cataloged in antivirus databases.

Key Features of Static Analysis:

• Compares the file against known malware techniques.
• Detects suspicious file modifications or embedded scripts.
• Identifies links to suspicious domains or IP addresses.

Why Is It Critical?

• Static analysis identifies sophisticated threats that might evade basic antivirus checks.

Sandboxing (Behavioral Analysis)

What Is Sandboxing?

• If an attachment passes static analysis but still appears suspicious, it is sent to a sandbox for behavioral analysis.
• The sandbox is a secure, isolated virtual environment where the file is opened and executed to observe its behavior.
• To enhance threat detection, the sandbox leverages multiple Machine Learning (ML) and AI models (AI) that analyze the file's actions and patterns during execution. These models are trained to detect malicious behaviors, such as attempts to exploit vulnerabilities, deploy ransomware, or initiate unauthorized data exfiltration.

What Does the Sandbox Look For?

• Whether the file attempts to modify system settings or files.
• Whether the file connects to suspicious external servers or downloads additional payloads.
• Whether the file tries to hide malicious activity to evade detection.
• It checks for a vast number of other malicious or suspicious actions that result in the file being flagged as unsafe.
• AI models evaluate subtle patterns that might indicate evasion tactics, such as delayed execution or attempts to detect the sandbox environment itself.

Importance of Machine Learning and AI Models

The following are reasons that ML and AI models are important for Attachment Protection scanning:

• Faster Detection: Machine learning algorithms can quickly identify deviations from normal behavior, reducing processing time.
• Evasion Detection: Advanced threats often try to avoid detection by behaving differently when they detect sandboxing. AI models are trained to recognize such tactics and flag them.
• Adaptability: With continuous learning, the system stays updated with evolving threat landscapes, detecting even zero-day vulnerabilities and advanced persistent threats (APTs).

Importance of Sandboxing

Sandboxing excels at detecting unknown threats, including zero-day vulnerabilities and advanced persistent threats (APTs) that traditional scanning methods may miss.

Final Decision- Safe or Unsafe 

Safe Attachments

• Attachments that pass all detection layers are marked as safe and delivered to your inbox.

Unsafe Attachments

• Files flagged at any stage are either quarantined for review or blocked entirely.
• You may receive a notification about blocked or unsafe files for visibility.

Benefits of this Process

The following lists reasons why this process is beneficial:

• Comprehensive Protection: Every attachment is scrutinized through multiple layers, ensuring that even the most sophisticated threats are detected and neutralized.
• Advanced Threat Detection: By combining static analysis and sandboxing, the system catches both known and emerging threats.
• Peace of Mind: You can confidently open your email attachments, knowing they have been thoroughly vetted for safety.