We are seeing emails with attachments coming through our Ironport ESA that are being used for Phishing. It was a PDF (or appears to be a PDF) attachment named Dropbox.PDF. When the user clicked on it, it brought up a bogus link to a dropbox that was asking to login with credentials.
How can we configure the ESA to scan attachments for Phishing and if we do will it catch something like this? Thanks
Depending on the PDF --- if the PDF only contains a URL that requires the end-user to interact and click on the URL to take them off-PDF and TO the malicious/phish site, the ESA currently is not capable of scanning that from AMP on ESA. These PDF files are usually flagged from AV rules, or VOF rules. AMP will take into account these rules, and readjust the scoring --- and will send out retrospective scoring adjustments based on the SHA reported from the ESA.
Any missed phish emails, emails with attachments - they can be directly submitted to Cisco:
email@example.com - Subject is prepended with [SUSPECTED SPAM] and is actual spam. Forwarding this will assist the product efficacy team confirm the content and possibly score it lower.
firstname.lastname@example.org - Subject is prepended with [SUSPECTED SPAM], but it is not spam, or Subject is prepended with [SUSPICIOUS], and may also contain other tags.
email@example.com - Untagged subject, but it appears to be a phishing (designed to acquire usernames, passwords, credit card info, or other personally identifiable information), or contains malware attachments
In Incoming Mail Policy, we recommend enabling Antivirus, AMP and Outbreak Filtering. In Outbreak filtering policy make sure to have Message Modification feature enabled with URL Rewrite so suspicious emails are tagged to warn end users about these emails. As long as the threat level is about 3 (default) it should trigger the tagging to warn users.