We are seeing emails with attachments coming through our Ironport ESA that are being used for Phishing. It was a PDF (or appears to be a PDF) attachment named Dropbox.PDF. When the user clicked on it, it brought up a bogus link to a dropbox that was asking to login with credentials.
How can we configure the ESA to scan attachments for Phishing and if we do will it catch something like this? Thanks
The Sophos scanning engine and AMP File reputation File Analysis features should scan for these phishing attachments.
If there are attachments missed by these it is recommended to open a TAC case to get the rules updated for newer threats.
Apart from that if you would like to block attachments with specific filenames you can certainly use content/message filters for the same.
Depending on the PDF --- if the PDF only contains a URL that requires the end-user to interact and click on the URL to take them off-PDF and TO the malicious/phish site, the ESA currently is not capable of scanning that from AMP on ESA. These PDF files are usually flagged from AV rules, or VOF rules. AMP will take into account these rules, and readjust the scoring --- and will send out retrospective scoring adjustments based on the SHA reported from the ESA.
Any missed phish emails, emails with attachments - they can be directly submitted to Cisco:
For full info:
In Incoming Mail Policy, we recommend enabling Antivirus, AMP and Outbreak Filtering. In Outbreak filtering policy make sure to have Message Modification feature enabled with URL Rewrite so suspicious emails are tagged to warn end users about these emails. As long as the threat level is about 3 (default) it should trigger the tagging to warn users.