ReddRadar
Agent skill
implementing-email-sandboxing-with-proofpoint
Email sandboxing detonates suspicious attachments and URLs in isolated environments to detect zero-day malware and evasive phishing payloads. Proofpoint Targeted Attack Protection (TAP) is an industry
Install this agent skill to your Project
npx add-skill https://github.com/autohandai/community-skills/tree/main/implementing-email-sandboxing-with-proofpoint
SKILL.md
Implementing Email Sandboxing with Proofpoint
Overview
Email sandboxing detonates suspicious attachments and URLs in isolated environments to detect zero-day malware and evasive phishing payloads. Proofpoint Targeted Attack Protection (TAP) is an industry-leading solution that uses multi-stage sandboxing, URL rewriting, and predictive analysis. This skill covers configuring Proofpoint TAP, integrating with email flow, analyzing sandbox reports, and tuning detection policies.
Prerequisites
- Proofpoint Email Protection license with TAP add-on
- Admin access to Proofpoint admin console
- Understanding of email delivery architecture (MX records, mail flow rules)
- SIEM integration capability
Key Concepts
Proofpoint TAP Capabilities
- Attachment sandboxing: Detonates files in virtual machines (Windows, macOS, Android)
- URL Defense: Rewrites URLs, detonates at time-of-click
- Threat Intelligence: Proofpoint's NexusAI threat intelligence integration
- TAP Dashboard: Real-time visibility into threats targeting the organization
- Campaign correlation: Groups related attacks into campaigns
- Very Attacked People (VAP): Identifies most-targeted individuals
Sandbox Evasion Techniques Detected
- Delayed execution (time-bomb malware)
- VM detection bypass
- User interaction requirements (click-to-enable macros)
- Sandbox-aware malware that checks for analysis environment
- Encrypted/password-protected attachments
- Multi-stage payloads with delayed C2 retrieval
Implementation Steps
Step 1: Configure TAP in Proofpoint
- Enable TAP for inbound email policy
- Configure sandbox profiles (attachment types to detonate)
- Set URL Defense rewriting policy
- Configure quarantine actions for malicious verdicts
Step 2: Tune Attachment Policies
Recommended attachment policy:
- Detonate: .exe, .dll, .scr, .doc(m), .xls(m), .ppt(m), .pdf, .zip, .rar, .7z, .iso
- Block without detonation: .bat, .cmd, .ps1, .vbs, .js, .wsf, .hta
- Password-protected archives: Attempt common passwords, then quarantine
- Dynamic delivery: Deliver email body, hold attachment until verdict
Step 3: Configure URL Defense
- Enable URL rewriting for all inbound email
- Set time-of-click detonation
- Block access to malicious URLs
- Show warning page for suspicious (not confirmed malicious) URLs
- Configure allowed domains bypass list
Step 4: Set Up TAP Dashboard Monitoring
- Configure daily threat digest emails to security team
- Set up real-time alerts for targeted attacks
- Monitor VAP report for high-risk users
- Review campaign clusters for coordinated attacks
Step 5: Integrate with SIEM
- Configure syslog/API export to SIEM
- Create correlation rules for TAP alerts
- Set up automated response workflows
Tools & Resources
- Proofpoint TAP: https://www.proofpoint.com/us/products/advanced-threat-protection
- Proofpoint TAP Dashboard: https://threatinsight.proofpoint.com/
- Proofpoint API: https://help.proofpoint.com/Threat_Insight_Dashboard/API_Documentation
- Proofpoint Community: https://community.proofpoint.com/
Validation
- Attachment detonation catches EICAR test file and macro-enabled document
- URL Defense rewrites and blocks known phishing URLs
- TAP Dashboard displays threat summary
- SIEM receives and alerts on TAP events
Recommended Agent Skills
Expand your agent's capabilities with these related and highly-rated skills.
autohandai/community-skills
mapping-mitre-attack-techniques
Maps observed adversary behaviors, security alerts, and detection rules to MITRE ATT&CK techniques and sub-techniques to quantify detection coverage and guide control prioritization. Use when building an ATT&CK-based coverage heatmap, tagging SIEM alerts with technique IDs, aligning security controls to adversary playbooks, or reporting threat exposure to executives. Activates for requests involving ATT&CK Navigator, Sigma rules, MITRE D3FEND, or coverage gap analysis.
autohandai/community-skills
hunting-for-spearphishing-indicators
Hunt for spearphishing campaign indicators across email logs, endpoint telemetry, and network data to detect targeted email attacks.
autohandai/community-skills
analyzing-malicious-url-with-urlscan
URLScan.io is a free service for scanning and analyzing suspicious URLs. It captures screenshots, DOM content, HTTP transactions, JavaScript behavior, and network connections of web pages in an isolat
autohandai/community-skills
implementing-zero-standing-privilege-with-cyberark
Deploy CyberArk Secure Cloud Access to eliminate standing privileges in hybrid and multi-cloud environments using just-in-time access with time, entitlement, and approval controls.
autohandai/community-skills
implementing-pam-for-database-access
Deploy privileged access management for database systems including Oracle, SQL Server, PostgreSQL, and MySQL. Covers session proxy configuration, credential vaulting, query auditing, dynamic credentia
autohandai/community-skills
detecting-t1003-credential-dumping-with-edr
Detect OS credential dumping techniques targeting LSASS memory, SAM database, NTDS.dit, and cached credentials using EDR telemetry, Sysmon process access monitoring, and Windows security event correlation.
Didn't find tool you were looking for?