Malware Detected in Email

Description

Detects when malware is found in an email received by a user. Identifies different malware families including known malicious programs, viruses, worms, harmful content, and unwanted content. Severity is dynamically assigned based on the malware type, with known malicious programs and viruses triggering high-severity alerts.

Query · python

# Malware family type mapping based on Google Workspace Gmail schema
# Reference: https://support.google.com/a/answer/12384955
MALWARE_FAMILY_TYPES = {
    1: "Known malicious program",
    2: "Virus or worm",
    3: "Possible harmful message content",
    4: "Possible unwanted message content",
    5: "Other malware type",
}


def rule(event):
    if event.deep_get("id", "applicationName", default="<UNKNOWN_APPLICATION>") != "gmail":
        return False

    # Check if malware was detected in the message
    malware_family = event.deep_get(
        "parameters", "message_info", "attachment", "malware_family", default=None
    )

    return malware_family is not None


def title(event):
    user = event.deep_get("actor", "email", default="<UNKNOWN_USER>")
    malware_family = event.deep_get(
        "parameters", "message_info", "attachment", "malware_family", default=0
    )
    malware_type = MALWARE_FAMILY_TYPES.get(malware_family, f"Unknown Type ({malware_family})")
    malware_sha256 = event.deep_get(
        "parameters", "message_info", "attachment", "sha256", default="<UNKNOWN_SHA256>"
    )

    return (
        f"Malicious attachment of type [{malware_type}] "
        f"with SHA256 [{malware_sha256}] "
        f"detected in email to [{user}]"
    )


def alert_context(event):
    malware_family = event.deep_get(
        "parameters", "message_info", "attachment", "malware_family", default=0
    )
    malware_sha256 = event.deep_get(
        "parameters", "message_info", "attachment", "sha256", default="<UNKNOWN_SHA256>"
    )
    filename = event.deep_get(
        "parameters", "message_info", "attachment", "file_name", default="<UNKNOWN_FILENAME>"
    )
    context = {
        "recipient": event.deep_get("actor", "email", default="<UNKNOWN_USER>"),
        "malware_family_code": malware_family,
        "malware_type": MALWARE_FAMILY_TYPES.get(malware_family, "Unknown"),
        "source_ip": event.get("ipAddress"),
        "sha256": malware_sha256,
        "filename": filename,
    }

    return context

Analyst notes

  1. Review the malware type and affected user
  2. Check if the email was quarantined or delivered
  3. Verify if the user interacted with the email or opened attachments
  4. Check for similar emails to other users in the organization
  5. Consider blocking the sender domain if appropriate
  6. Notify the affected user and provide security awareness guidance
Raw source Malware Detected in Email · Panther Python
Esc
Published by panther-labs/panther-analysis ↗, licensed under Apache 2.0 ↗. Reproduced here unmodified. 
AnalysisType: rule
Filename: gsuite_malware_in_email.py
RuleID: "GSuite.Gmail.Malware.In.Email"
DisplayName: "Malware Detected in Email"
Enabled: true
LogTypes:
  - GSuite.ActivityEvent
Tags:
  - GSuite
  - Gmail
  - Malware
  - Initial Access
Reports:
  MITRE ATT&CK:
    - TA0001:T1566.001 # Initial Access: Phishing - Spearphishing Attachment
    - TA0011:T1204.002 # Execution: User Execution - Malicious File
Severity: High
Description: >
  Detects when malware is found in an email received by a user. Identifies different malware families including known malicious programs, viruses, worms, harmful content, and unwanted content. Severity is dynamically assigned based on the malware type, with known malicious programs and viruses triggering high-severity alerts.
Runbook: |
  1. Review the malware type and affected user
  2. Check if the email was quarantined or delivered
  3. Verify if the user interacted with the email or opened attachments
  4. Check for similar emails to other users in the organization
  5. Consider blocking the sender domain if appropriate
  6. Notify the affected user and provide security awareness guidance
Reference: https://support.google.com/a/answer/12384955
DedupPeriodMinutes: 60
Tests:
  - Name: Known Malicious Program Detected
    ExpectedResult: true
    Log:
      {
        "p_any_ip_addresses": ["1.1.1.1"],
        "p_any_actor_ids": ["1234567891234"],
        "p_any_domain_names": ["malicious-sender.com"],
        "p_event_time": "2025-11-04 20:44:43.248000000",
        "p_log_type": "GSuite.ActivityEvent",
        "p_parse_time": "2025-11-04 20:49:46.688935963",
        "p_row_id": "0000000000de09c1dc6f0828cbad2ca5",
        "p_schema_version": 0,
        "p_source_id": "7ee69d4d-df1b-40b3-b5e8-6826dee34b1c",
        "p_source_label": "Google Workspace",
        "actor": {
          "callerType": "USER",
          "email": "oliver@justice.org",
          "profileId": "123456789"
        },
        "id": {
          "applicationName": "gmail",
          "customerId": "C12345",
          "time": "2025-11-04 20:44:43.248000000",
          "uniqueQualifier": "-123456789"
        },
        "ipAddress": "1.1.1.1",
        "kind": "admin#reports#activity",
        "name": "delivery",
        "parameters": {
          "event_info": {
            "elapsed_time_usec": 368746,
            "timestamp_usec": 1730751883248347
          },
          "message_info": {
            "action_type": 19,
            "subject": "Important Invoice Attached",
            "num_message_attachments": 1,
            "payload_size": 54321,
            "link_domain": ["malicious-sender.com"],
            "attachment": {
              "malware_family": 1,
              "file_name": "invoice.exe",
              "sha256": "000000000045c5798d026b67c03d54273fd0996f5cb789d0a959dac0c7cc456c"
            }
          }
        },
        "type": "delivery_type"
      }

  - Name: Virus or Worm Detected
    ExpectedResult: true
    Log:
      {
        "p_event_time": "2025-11-04 20:45:00.000000000",
        "p_log_type": "GSuite.ActivityEvent",
        "actor": {
          "callerType": "USER",
          "email": "john@justice.org",
          "profileId": "987654321"
        },
        "id": {
          "applicationName": "gmail",
          "customerId": "C12345",
          "time": "2025-11-04 20:45:00.000000000"
        },
        "ipAddress": "1.1.1.1",
        "kind": "admin#reports#activity",
        "name": "delivery",
        "parameters": {
          "message_info": {
            "subject": "RE: Meeting Notes",
            "is_spam": false,
            "num_message_attachments": 1,
            "attachment": {
              "malware_family": 2,
              "file_name": "notes.doc",
              "sha256": "b2c3d4e5f6789012345678901234567890123456789012345678901234abcde"
            }
          }
        },
        "type": "delivery_type"
      }

  - Name: Possible Harmful Content
    ExpectedResult: true
    Log:
      {
        "p_event_time": "2025-11-04 20:46:00.000000000",
        "p_log_type": "GSuite.ActivityEvent",
        "actor": {
          "callerType": "USER",
          "email": "hal@justice.org",
          "profileId": "111222333"
        },
        "id": {
          "applicationName": "gmail",
          "customerId": "C12345",
          "time": "2025-11-04 20:46:00.000000000"
        },
        "ipAddress": "1.1.1.1",
        "kind": "admin#reports#activity",
        "name": "delivery",
        "parameters": {
          "message_info": {
            "subject": "Urgent: Click here now",
            "link_domain": ["suspicious-link.com"],
            "attachment": {
              "malware_family": 3,
              "file_name": "update.zip",
              "sha256": "c3d4e5f6789012345678901234567890123456789012345678901234abcdef"
            }
          }
        },
        "type": "delivery_type"
      }

  - Name: Possible Unwanted Content
    ExpectedResult: true
    Log:
      {
        "p_event_time": "2025-11-04 20:47:00.000000000",
        "p_log_type": "GSuite.ActivityEvent",
        "actor": {
          "callerType": "USER",
          "email": "barry@justice.org",
          "profileId": "444555666"
        },
        "id": {
          "applicationName": "gmail",
          "customerId": "C12345",
          "time": "2025-11-04 20:47:00.000000000"
        },
        "ipAddress": "1.1.1.1",
        "kind": "admin#reports#activity",
        "name": "delivery",
        "parameters": {
          "message_info": {
            "subject": "Free Software Download",
            "is_spam": true,
            "attachment": {
              "malware_family": 4,
              "file_name": "freeware.exe",
              "sha256": "d4e5f6789012345678901234567890123456789012345678901234abcdef0"
            }
          }
        },
        "type": "delivery_type"
      }

  - Name: Other Malware Type
    ExpectedResult: true
    Log:
      {
        "p_event_time": "2025-11-04 20:48:00.000000000",
        "p_log_type": "GSuite.ActivityEvent",
        "actor": {
          "callerType": "USER",
          "email": "bruce@justice.org",
          "profileId": "777888999"
        },
        "id": {
          "applicationName": "gmail",
          "customerId": "C12345",
          "time": "2025-11-04 20:48:00.000000000"
        },
        "ipAddress": "1.1.1.1",
        "kind": "admin#reports#activity",
        "name": "delivery",
        "parameters": {
          "message_info": {
            "subject": "Encrypted Document",
            "attachment": {
              "malware_family": 5,
              "file_name": "document.pdf",
              "sha256": "e5f6789012345678901234567890123456789012345678901234abcdef01"
            }
          }
        },
        "type": "delivery_type"
      }

  - Name: Clean Email No Malware
    ExpectedResult: false
    Log:
      {
        "p_event_time": "2025-11-04 20:50:00.000000000",
        "p_log_type": "GSuite.ActivityEvent",
        "actor": {
          "callerType": "USER",
          "email": "john@justice.org",
          "profileId": "123123123"
        },
        "id": {
          "applicationName": "gmail",
          "customerId": "C12345",
          "time": "2025-11-04 20:50:00.000000000"
        },
        "ipAddress": "1.1.1.1",
        "kind": "admin#reports#activity",
        "name": "delivery",
        "parameters": {
          "message_info": {
            "subject": "Team Lunch Tomorrow",
            "is_spam": false,
            "action_type": 19
          }
        },
        "type": "delivery_type"
      }

  - Name: Non-Gmail Application Event
    ExpectedResult: false
    Log:
      {
        "p_event_time": "2025-11-04 20:51:00.000000000",
        "p_log_type": "GSuite.ActivityEvent",
        "actor": {
          "callerType": "USER",
          "email": "diana@justice.org",
          "profileId": "999888777"
        },
        "id": {
          "applicationName": "drive",
          "customerId": "C12345",
          "time": "2025-11-04 20:51:00.000000000"
        },
        "ipAddress": "1.1.1.1",
        "kind": "admin#reports#activity",
        "name": "upload",
        "parameters": {
          "doc_title": "Important Document.pdf"
        },
        "type": "access"
      }

# ------ paired body: gsuite_malware_in_email.py ------

# Malware family type mapping based on Google Workspace Gmail schema
# Reference: https://support.google.com/a/answer/12384955
MALWARE_FAMILY_TYPES = {
    1: "Known malicious program",
    2: "Virus or worm",
    3: "Possible harmful message content",
    4: "Possible unwanted message content",
    5: "Other malware type",
}


def rule(event):
    if event.deep_get("id", "applicationName", default="<UNKNOWN_APPLICATION>") != "gmail":
        return False

    # Check if malware was detected in the message
    malware_family = event.deep_get(
        "parameters", "message_info", "attachment", "malware_family", default=None
    )

    return malware_family is not None


def title(event):
    user = event.deep_get("actor", "email", default="<UNKNOWN_USER>")
    malware_family = event.deep_get(
        "parameters", "message_info", "attachment", "malware_family", default=0
    )
    malware_type = MALWARE_FAMILY_TYPES.get(malware_family, f"Unknown Type ({malware_family})")
    malware_sha256 = event.deep_get(
        "parameters", "message_info", "attachment", "sha256", default="<UNKNOWN_SHA256>"
    )

    return (
        f"Malicious attachment of type [{malware_type}] "
        f"with SHA256 [{malware_sha256}] "
        f"detected in email to [{user}]"
    )


def alert_context(event):
    malware_family = event.deep_get(
        "parameters", "message_info", "attachment", "malware_family", default=0
    )
    malware_sha256 = event.deep_get(
        "parameters", "message_info", "attachment", "sha256", default="<UNKNOWN_SHA256>"
    )
    filename = event.deep_get(
        "parameters", "message_info", "attachment", "file_name", default="<UNKNOWN_FILENAME>"
    )
    context = {
        "recipient": event.deep_get("actor", "email", default="<UNKNOWN_USER>"),
        "malware_family_code": malware_family,
        "malware_type": MALWARE_FAMILY_TYPES.get(malware_family, "Unknown"),
        "source_ip": event.get("ipAddress"),
        "sha256": malware_sha256,
        "filename": filename,
    }

    return context

Detection rules belong to the projects that publish them and remain under their own licenses. This site indexes and links to them; it claims no rights in them.