Showing results for 
Search instead for 
Did you mean: 
Cisco Secure Email Support Community

Product Support Talos Support Cisco Support Reference + Current Release
Gateway Reputation Lookup Open a support case Secure Email Guided Setup
Gateway: 14.2.0-616
Cloud Gateway Email Status Portal Support & Downloads
Email and Web Manager: 14.2.0-203
Email and Web Manager Web & Email Reputation Worldwide Contacts Product Naming Quick Reference
Reporting Plug-in:
Encryption Bug Search
Encryption Plug-in:
Cloud Mailbox Notification Service
Outlook Add-in(s): More info


Scaning for Phishing in an Attachment


 We are seeing emails with attachments coming through our Ironport ESA that are being used for Phishing. It was a PDF (or appears to be a PDF) attachment named Dropbox.PDF. When the user clicked on it, it brought up a bogus link to a dropbox that was asking to login with credentials.

How can we configure the ESA to scan attachments for Phishing and if we do will it catch something like this? Thanks

Libin Varghese
Cisco Employee


The Sophos scanning engine and AMP File reputation File Analysis features should scan for these phishing attachments.

If there are attachments missed by these it is recommended to open a TAC case to get the rules updated for newer threats.

Apart from that if you would like to block attachments with specific filenames you can certainly use content/message filters for the same.

Thank You!

Libin Varghese

Robert Sherwin
Cisco Employee

Depending on the PDF --- if the PDF only contains a URL that requires the end-user to interact and click on the URL to take them off-PDF and TO the malicious/phish site, the ESA currently is not capable of scanning that from AMP on ESA.  These PDF files are usually flagged from AV rules, or VOF rules.  AMP will take into account these rules, and readjust the scoring --- and will send out retrospective scoring adjustments based on the SHA reported from the ESA.

Any missed phish emails, emails with attachments - they can be directly submitted to Cisco:

  • - Subject is prepended with [SUSPECTED SPAM] and is actual spam.  Forwarding this will assist the product efficacy team confirm the content and possibly score it lower.
  • - Subject is prepended with [SUSPECTED SPAM], but it is not spam, or Subject is prepended with [SUSPICIOUS], and may also contain other tags.
  • - Untagged subject, but you consider it to be or contain marketing content.
  • - Subject is prepended with [MARKETING], but you do not consider it marketing.
  • - Untagged subject, but it appears to be a phishing (designed to acquire usernames, passwords, credit card info, or other personally identifiable information), or contains malware attachments

For full info:

ESA FAQ: How to submit email messages to Cisco


Venkatesh Attuluri
Cisco Employee

make sure you have enabled AMP file Analysis and selected all file types for file analysis

Sriram Subramanian
Cisco Employee

In Incoming Mail Policy, we recommend enabling Antivirus, AMP and Outbreak Filtering. In Outbreak filtering policy make sure to have Message Modification feature enabled with URL Rewrite so suspicious emails are tagged to warn end users about these emails. As long as the threat level is about 3 (default) it should trigger the tagging to warn users.

Recognize Your Peers
Content for Community-Ad