Proofpoint Multiple Threats Detected

Description

This rule alerts when three or more active threats are detected in a single email message. This indicates a sophisticated multi-vector attack combining malware, phishing URLs, and malicious attachments. Severity is dynamic: CRITICAL (5+ threats), HIGH (3-4 threats).

Query · python

from panther_proofpoint_helpers import proofpoint_alert_context


def get_active_threat_count(event):
    # Count the number of active threats in the event using list comprehension
    return len([t for t in event.get("threatsInfoMap", []) if t.get("threatStatus") == "active"])


def rule(event):
    # Must have at least 3 active threats to reduce overlap with single-vector rules
    return get_active_threat_count(event) >= 3


def severity(event):
    active_count = get_active_threat_count(event)

    if active_count >= 5:
        return "CRITICAL"
    if active_count >= 3:
        return "HIGH"
    return "DEFAULT"


def dedup(event):
    sender = event.get("sender", "<UNKNOWN_SENDER>")
    return f"proofpoint:multiple_threats:{sender}"


def title(event):
    sender = event.get("sender", "<UNKNOWN_SENDER>")
    active_count = get_active_threat_count(event)
    return f"Proofpoint: Multiple Threats Detected ({active_count}) - Email from {sender}"


def alert_context(event):
    # Use the common helper
    context = proofpoint_alert_context(event)

    # Filter to only active threats
    all_threats = context["threats"]
    active_threats = [t for t in all_threats if t.get("threatStatus") == "active"]
    threat_types = set(t.get("threatType") for t in active_threats if t.get("threatType"))
    classifications = set(
        t.get("classification") for t in active_threats if t.get("classification")
    )

    # Extend with multiple threat-specific fields
    context.update(
        {
            "threatCount": len(active_threats),
            "threatTypes": list(threat_types),
            "classifications": list(classifications),
            "threats": active_threats,
        }
    )
    return context

Analyst notes

  1. Verify the email was quarantined and review all threat types in the alert context immediately
  2. Block sender infrastructure within 15 minutes and search for similar multi-vector attacks from the last 7 days
  3. Escalate to threat intelligence team within 1 hour for campaign analysis and update security controls
Raw source Proofpoint Multiple Threats Detected · Panther Python
Esc
Published by panther-labs/panther-analysis ↗, licensed under Apache 2.0 ↗. Reproduced here unmodified. 
AnalysisType: rule
Filename: proofpoint_multiple_threats.py
RuleID: "Proofpoint.MultipleThreats"
DisplayName: "Proofpoint Multiple Threats Detected"
Enabled: true
LogTypes:
  - Proofpoint.Event
Status: Experimental
Tags:
  - Proofpoint
  - Email Security
  - Phishing
  - Malware
  - Initial Access:Phishing
  - Execution:User Execution
Severity: High
Description: >
  This rule alerts when three or more active threats are detected in a single
  email message. This indicates a sophisticated multi-vector attack combining
  malware, phishing URLs, and malicious attachments. Severity is dynamic:
  CRITICAL (5+ threats), HIGH (3-4 threats).
Runbook: |
  1. Verify the email was quarantined and review all threat types in the alert context immediately
  2. Block sender infrastructure within 15 minutes and search for similar multi-vector attacks from the last 7 days
  3. Escalate to threat intelligence team within 1 hour for campaign analysis and update security controls
Reference: https://www.proofpoint.com/us/resources/webinars/blocking-multi-vector-attacks
Reports:
  MITRE ATT&CK:
    - TA0001:T1566 # Initial Access: Phishing
    - TA0002:T1204 # Execution: User Execution
Tests:
  - Name: Two Active Threats - No Alert
    ExpectedResult: false
    Log:
      messageTime: "2026-01-08T12:00:00Z"
      sender: "attacker@evil.com"
      senderIP: "192.0.2.88"
      fromAddress:
        - "attacker@evil.com"
      toAddresses:
        - "victim@company.com"
      recipient:
        - "victim@company.com"
      subject: "Urgent Action Required"
      malwareScore: 80
      phishScore: 75
      spamScore: 20
      impostorScore: 10
      quarantineFolder: "Attachment Defense"
      quarantineRule: "threat"
      messageID: "<multi-threat@evil.com>"
      threatsInfoMap:
        - threatType: "attachment"
          classification: "malware"
          threatStatus: "active"
          threat: "invoice.exe"
          threatID: "threat-001"
        - threatType: "url"
          classification: "phish"
          threatStatus: "active"
          threat: "http://fake-login.com/verify"
          threatID: "threat-002"
  - Name: Five Active Threats - Critical
    ExpectedResult: true
    Log:
      messageTime: "2026-01-08T13:30:00Z"
      sender: "sophisticated@attacker.net"
      senderIP: "198.51.100.123"
      fromAddress:
        - "sophisticated@attacker.net"
      toAddresses:
        - "target@company.com"
      recipient:
        - "target@company.com"
      subject: "Critical Update Required"
      malwareScore: 95
      phishScore: 90
      spamScore: 50
      impostorScore: 20
      quarantineFolder: "Attachment Defense"
      quarantineRule: "threat"
      messageID: "<advanced-threat@attacker.net>"
      threatsInfoMap:
        - threatType: "attachment"
          classification: "malware"
          threatStatus: "active"
          threat: "update.zip"
          threatID: "threat-003"
        - threatType: "url"
          classification: "phish"
          threatStatus: "active"
          threat: "http://phish1.com"
          threatID: "threat-004"
        - threatType: "url"
          classification: "phish"
          threatStatus: "active"
          threat: "http://phish2.com"
          threatID: "threat-005"
        - threatType: "attachment"
          classification: "malware"
          threatStatus: "active"
          threat: "document.pdf"
          threatID: "threat-006"
        - threatType: "url"
          classification: "malware"
          threatStatus: "active"
          threat: "http://malware-download.com"
          threatID: "threat-007"
  - Name: Three Active Threats - High Severity
    ExpectedResult: true
    Log:
      messageTime: "2026-01-08T14:00:00Z"
      sender: "bad-actor@malicious.org"
      senderIP: "203.0.113.77"
      fromAddress:
        - "bad-actor@malicious.org"
      toAddresses:
        - "employee@company.com"
      recipient:
        - "employee@company.com"
      subject: "Invoice Attached"
      malwareScore: 70
      phishScore: 65
      spamScore: 15
      impostorScore: 5
      quarantineFolder: "Attachment Defense"
      quarantineRule: "threat"
      messageID: "<triple-threat@malicious.org>"
      threatsInfoMap:
        - threatType: "attachment"
          classification: "malware"
          threatStatus: "active"
          threat: "invoice.doc"
          threatID: "threat-008"
        - threatType: "url"
          classification: "phish"
          threatStatus: "active"
          threat: "http://credential-stealer.com"
          threatID: "threat-009"
        - threatType: "url"
          classification: "malware"
          threatStatus: "active"
          threat: "http://drive-by-download.net"
          threatID: "threat-010"
  - Name: One Active Threat - No Alert
    ExpectedResult: false
    Log:
      messageTime: "2026-01-08T15:00:00Z"
      sender: "sender@example.com"
      senderIP: "198.51.100.50"
      fromAddress:
        - "sender@example.com"
      toAddresses:
        - "user@company.com"
      recipient:
        - "user@company.com"
      subject: "Suspicious Link"
      malwareScore: 5
      phishScore: 60
      spamScore: 10
      impostorScore: 0
      quarantineFolder: "Phish"
      quarantineRule: "phish"
      messageID: "<single-threat@example.com>"
      threatsInfoMap:
        - threatType: "url"
          classification: "phish"
          threatStatus: "active"
          threat: "http://phishing-site.com"
          threatID: "threat-011"
  - Name: One Active With Multiple Cleared - No Alert
    ExpectedResult: false
    Log:
      messageTime: "2026-01-08T15:30:00Z"
      sender: "mixed-status@example.com"
      senderIP: "203.0.113.88"
      fromAddress:
        - "mixed-status@example.com"
      toAddresses:
        - "user@company.com"
      recipient:
        - "user@company.com"
      subject: "Mixed Threat Status"
      malwareScore: 30
      phishScore: 40
      spamScore: 15
      impostorScore: 0
      quarantineFolder: "Phish"
      quarantineRule: "phish"
      messageID: "<mixed-threats@example.com>"
      threatsInfoMap:
        - threatType: "url"
          classification: "phish"
          threatStatus: "active"
          threat: "http://active-phish.com"
          threatID: "threat-014"
        - threatType: "attachment"
          classification: "malware"
          threatStatus: "cleared"
          threat: "old-malware.exe"
          threatID: "threat-015"
        - threatType: "url"
          classification: "malware"
          threatStatus: "cleared"
          threat: "http://cleared-malware.com"
          threatID: "threat-016"
  - Name: Multiple Threats But Not Active - No Alert
    ExpectedResult: false
    Log:
      messageTime: "2026-01-08T16:00:00Z"
      sender: "old-threat@example.com"
      senderIP: "203.0.113.99"
      fromAddress:
        - "old-threat@example.com"
      toAddresses:
        - "user@company.com"
      recipient:
        - "user@company.com"
      subject: "Old Campaign"
      malwareScore: 10
      phishScore: 10
      spamScore: 5
      impostorScore: 0
      messageID: "<inactive-threats@example.com>"
      threatsInfoMap:
        - threatType: "url"
          classification: "phish"
          threatStatus: "cleared"
          threat: "http://old-phish.com"
          threatID: "threat-012"
        - threatType: "attachment"
          classification: "malware"
          threatStatus: "cleared"
          threat: "old-malware.exe"
          threatID: "threat-013"


# ------ paired body: proofpoint_multiple_threats.py ------

from panther_proofpoint_helpers import proofpoint_alert_context


def get_active_threat_count(event):
    # Count the number of active threats in the event using list comprehension
    return len([t for t in event.get("threatsInfoMap", []) if t.get("threatStatus") == "active"])


def rule(event):
    # Must have at least 3 active threats to reduce overlap with single-vector rules
    return get_active_threat_count(event) >= 3


def severity(event):
    active_count = get_active_threat_count(event)

    if active_count >= 5:
        return "CRITICAL"
    if active_count >= 3:
        return "HIGH"
    return "DEFAULT"


def dedup(event):
    sender = event.get("sender", "<UNKNOWN_SENDER>")
    return f"proofpoint:multiple_threats:{sender}"


def title(event):
    sender = event.get("sender", "<UNKNOWN_SENDER>")
    active_count = get_active_threat_count(event)
    return f"Proofpoint: Multiple Threats Detected ({active_count}) - Email from {sender}"


def alert_context(event):
    # Use the common helper
    context = proofpoint_alert_context(event)

    # Filter to only active threats
    all_threats = context["threats"]
    active_threats = [t for t in all_threats if t.get("threatStatus") == "active"]
    threat_types = set(t.get("threatType") for t in active_threats if t.get("threatType"))
    classifications = set(
        t.get("classification") for t in active_threats if t.get("classification")
    )

    # Extend with multiple threat-specific fields
    context.update(
        {
            "threatCount": len(active_threats),
            "threatTypes": list(threat_types),
            "classifications": list(classifications),
            "threats": active_threats,
        }
    )
    return context

Detection rules belong to the projects that publish them and remain under their own licenses. This site indexes and links to them; it claims no rights in them.