Proofpoint Malware Detected

Description

This rule alerts when Proofpoint detects malware in an email message. It triggers when emails are quarantined with the malware rule or when the malware score is 90 or higher. Events quarantined to the Virus folder or with the notcleaned rule are handled by the Virus Detected rule instead.

Query · python

from panther_proofpoint_helpers import proofpoint_alert_context


def rule(event):
    # Exclude events already handled by the Virus Detected rule
    if event.get("quarantineFolder") == "Virus" or event.get("quarantineRule") == "notcleaned":
        return False
    return event.get("quarantineRule") == "malware" or event.get("malwareScore", 0) >= 90


def severity(event):
    malware_score = event.get("malwareScore", 0)

    if malware_score >= 95:
        return "CRITICAL"
    if malware_score >= 90:
        return "HIGH"
    return "DEFAULT"


def title(event):
    subject = event.get("subject", "<UNKNOWN_SUBJECT>")
    sender = event.get("sender", "<UNKNOWN_SENDER>")
    return f"Proofpoint: Malware Detected in Email from {sender} " f"- [{subject}]"


def dedup(event):
    # Deduplicate by sender and threat type to group related malware alerts
    sender = event.get("sender", "<UNKNOWN_SENDER>")
    quarantine_rule = event.get("quarantineRule", "malware")
    return f"proofpoint:malware:{sender}:{quarantine_rule}"


def alert_context(event):
    # Use the common helper and extend with malware-specific fields
    context = proofpoint_alert_context(event)
    context["messageSize"] = event.get("messageSize", 0)
    return context

Analyst notes

  1. Verify the email was quarantined and check if recipients interacted with malicious content within the last 2 hours
  2. Block the sender domain/IP within 15 minutes and notify affected users immediately
  3. Escalate to IR team within 30 minutes if malware execution is confirmed on endpoints
Raw source Proofpoint Malware Detected · Panther Python
Esc
Published by panther-labs/panther-analysis ↗, licensed under Apache 2.0 ↗. Reproduced here unmodified. 
AnalysisType: rule
Filename: proofpoint_malware_detected.py
RuleID: "Proofpoint.MalwareDetected"
DisplayName: "Proofpoint Malware Detected"
Enabled: true
LogTypes:
  - Proofpoint.Event
Status: Experimental
Tags:
  - Proofpoint
  - Email Security
  - Malware
  - Phishing
  - Initial Access:Phishing
  - Execution:User Execution
Severity: High
Description: >
  This rule alerts when Proofpoint detects malware in an email message.
  It triggers when emails are quarantined with the malware rule or when
  the malware score is 90 or higher. Events quarantined to the Virus folder
  or with the notcleaned rule are handled by the Virus Detected rule instead.
Runbook: |
  1. Verify the email was quarantined and check if recipients interacted with malicious content within the last 2 hours
  2. Block the sender domain/IP within 15 minutes and notify affected users immediately
  3. Escalate to IR team within 30 minutes if malware execution is confirmed on endpoints
Reference: https://www.proofpoint.com/sites/default/files/pfpt-us-ebook-stopping-malware-with-proofpoint-advanced-email-protection.pdf
Reports:
  MITRE ATT&CK:
    - TA0001:T1566 # Initial Access: Phishing
    - TA0002:T1204 # Execution: User Execution
Tests:
  - Name: Malware Quarantine Rule Match
    ExpectedResult: true
    Log:
      messageTime: "2026-01-08T23:57:06Z"
      sender: "malicious@example.com"
      senderIP: "192.0.2.1"
      fromAddress:
        - "malicious@example.com"
      toAddresses:
        - "victim@company.com"
      recipient:
        - "victim@company.com"
      subject: "Invoice Attached"
      malwareScore: 100
      phishScore: 0
      spamScore: 0
      impostorScore: 0
      quarantineFolder: "Malware"
      quarantineRule: "malware"
      messageID: "<20021004025021.15821.qmail@example.com>"
      messageSize: 202302
      modulesRun:
        - av
        - sandbox
        - spam
        - dmarc
      threatsInfoMap:
        - threatType: "attachment"
          classification: "malware"
          threatStatus: "active"
          threat: "invoice.exe"
          threatID: "9be9e4c4cc2679586acb2511b3ae0505be51c07d32e1071bc4bb95cfe3383b9f"
  - Name: High Malware Score
    ExpectedResult: true
    Log:
      messageTime: "2026-01-08T23:57:06Z"
      sender: "suspicious@example.com"
      senderIP: "198.51.100.1"
      fromAddress:
        - "suspicious@example.com"
      toAddresses:
        - "user@company.com"
      recipient:
        - "user@company.com"
      subject: "Urgent: Update Required"
      malwareScore: 95
      phishScore: 10
      spamScore: 20
      impostorScore: 0
      quarantineFolder: "Attachment Defense"
      quarantineRule: "threat"
      messageID: "<abc123@example.com>"
      threatsInfoMap:
        - threatType: "attachment"
          classification: "malware"
          threatStatus: "active"
          threat: "update.zip"
  - Name: Boundary Case - Score 89 Below Threshold
    ExpectedResult: false
    Log:
      messageTime: "2026-01-08T23:00:00Z"
      sender: "borderline@example.com"
      senderIP: "198.51.100.25"
      fromAddress:
        - "borderline@example.com"
      toAddresses:
        - "user@company.com"
      recipient:
        - "user@company.com"
      subject: "Document Attached"
      malwareScore: 89
      phishScore: 10
      spamScore: 15
      impostorScore: 0
      quarantineFolder: "Attachment Defense"
      quarantineRule: "threat"
      messageID: "<boundary89@example.com>"
  - Name: Low Malware Score - No Alert
    ExpectedResult: false
    Log:
      messageTime: "2026-01-08T23:57:06Z"
      sender: "legitimate@company.com"
      senderIP: "203.0.113.1"
      fromAddress:
        - "legitimate@company.com"
      toAddresses:
        - "employee@company.com"
      recipient:
        - "employee@company.com"
      subject: "Meeting Notes"
      malwareScore: 0
      phishScore: 0
      spamScore: 5
      impostorScore: 0
      messageID: "<normal123@company.com>"
  - Name: Virus Quarantine Excluded - No Alert
    ExpectedResult: false
    Log:
      messageTime: "2026-01-08T23:57:06Z"
      sender: "virus@example.com"
      senderIP: "192.0.2.10"
      fromAddress:
        - "virus@example.com"
      toAddresses:
        - "employee@company.com"
      recipient:
        - "employee@company.com"
      subject: "Infected File"
      malwareScore: 100
      phishScore: 0
      spamScore: 0
      impostorScore: 0
      quarantineFolder: "Virus"
      quarantineRule: "notcleaned"
      messageID: "<virus-excluded@example.com>"
  - Name: Different Quarantine Rule - No Alert
    ExpectedResult: false
    Log:
      messageTime: "2026-01-08T23:57:06Z"
      sender: "spam@example.com"
      senderIP: "198.51.100.50"
      fromAddress:
        - "spam@example.com"
      toAddresses:
        - "user@company.com"
      recipient:
        - "user@company.com"
      subject: "Buy Now!"
      malwareScore: 0
      phishScore: 0
      spamScore: 95
      impostorScore: 0
      quarantineFolder: "Definite Spam"
      quarantineRule: "spam_definite"
      messageID: "<spam456@example.com>"


# ------ paired body: proofpoint_malware_detected.py ------

from panther_proofpoint_helpers import proofpoint_alert_context


def rule(event):
    # Exclude events already handled by the Virus Detected rule
    if event.get("quarantineFolder") == "Virus" or event.get("quarantineRule") == "notcleaned":
        return False
    return event.get("quarantineRule") == "malware" or event.get("malwareScore", 0) >= 90


def severity(event):
    malware_score = event.get("malwareScore", 0)

    if malware_score >= 95:
        return "CRITICAL"
    if malware_score >= 90:
        return "HIGH"
    return "DEFAULT"


def title(event):
    subject = event.get("subject", "<UNKNOWN_SUBJECT>")
    sender = event.get("sender", "<UNKNOWN_SENDER>")
    return f"Proofpoint: Malware Detected in Email from {sender} " f"- [{subject}]"


def dedup(event):
    # Deduplicate by sender and threat type to group related malware alerts
    sender = event.get("sender", "<UNKNOWN_SENDER>")
    quarantine_rule = event.get("quarantineRule", "malware")
    return f"proofpoint:malware:{sender}:{quarantine_rule}"


def alert_context(event):
    # Use the common helper and extend with malware-specific fields
    context = proofpoint_alert_context(event)
    context["messageSize"] = event.get("messageSize", 0)
    return context

Detection rules belong to the projects that publish them and remain under their own licenses. This site indexes and links to them; it claims no rights in them.