WitFoo-Artifact ::: action=block ::: message={"spamScore":0,"phishScore":0,"threatsInfoMap":[{"threatID":"2837aa505f82ca7ea16d4d1498940def72b64d002d264d47527a27a34e0c12ff","threatStatus":"active","classification":"phish","threatUrl":"https://threatinsight.proofpoint.com/4a6c87e3-5385-8727-3248-aa120bda900c/threat/email/2837aa505f82ca7ea16d4d1498940def72b64d002d264d47527a27a34e0c12ff","threatTime":"2023-06-14T00:41:21.000Z","threat":"2837aa505f82ca7ea16d4d1498940def72b64d002d264d47527a27a34e0c12ff","campaignID":null,"threatType":"attwaynement"}],"messageTime":"2023-06-14T00:42:36.000Z","impostorScore":0,"malwareScore":0,"cluster":"wayne_hosted","subject":"Remittance Advice","quarantineFolder":"Attwaynement Defense","quarantineRule":"threat","policyRoutes":["default_inbound","wayne_from"],"modulesRun":["access","av","zerohour","dkimv","spf","sandbox","spam","dmarc","urldefense"],"messageSize":21183,"headerFrom":"accountspayable@wayne.bank","headerReplyTo":null,"fromAddress":["accountspayable@wayne.bank"],"ccAddresses":[],"replyToAddress":[],"toAddresses":["accountspayable@wayne.bank"],"xmailer":null,"messageParts":[{"disposition":"inline","sha256":"2837aa505f82ca7ea16d4d1498940def72b64d002d264d47527a27a34e0c12ff","md5":"fa1d07e4947ed8fd14ea92ba3e2740f3","filename":"remittance-advice.html","sandboxStatus":"THREAT","oContentType":"text/html","contentType":"text/html"}],"completelyRewritten":false,"id":"75f72172-e28f-5063-37ac-0c4454248c5f","QID":"3r4n1t96ev-1","GUID":"mxWwWdMt-u0L_WNPwg6UBYGn1aoEXjMt","sender":"bounces+9826919-8cbe-accountspayable=wayne.bank@em7685.derco.cl","recipient":["accountspayable@wayne.bank"],"senderIP":"151.140.0.138","messageID":"<2b39ffaa-9712-e1e0-34b1-eee6a75b0b7c@wayne.bank>"} ::: fileHash=<2b39ffaa-9712-e1e0-34b1-eee6a75b0b7c@wayne.bank> ::: fileName=from: bounces+9826919-8cbe-accountspayable=wayne.bank@em7685.derco.cl subj: Remittance Advice ::: serverIP=151.140.0.138 ::: emailFrom=bounces+9826919-8cbe-accountspayable=wayne.bank@em7685.derco.cl ::: created_at=2023-06-14T00:42:36.000Z ::: streamName=proofpoint_protect ::: vendorCode=blocked_message ::: messageType=email_protection_event ::: emailSubject=Remittance Advice ::: pipelineName=proofpoint_protect ::: severityCode=2 ::: startTimeUTC=2023-06-14T00:42:36.000Z ::: emailSendingServer=151.140.0.138 ::: pipelineEntrypoint=dispatch
{
    "action": "block",
    "emailfrom": "bounces+9826919-8cbe-accountspayable=calprivate.bank@em7685.derco.cl",
    "emailsendingserver": "167.89.18.14",
    "emailsubject": "Remittance Advice",
    "filehash": "<2b39ffaa-9712-e1e0-34b1-eee6a75b0b7c@calprivate.bank>",
    "filename": "from: bounces+9826919-8cbe-accountspayable=calprivate.bank@em7685.derco.cl subj: Remittance Advice",
    "message": "WitFoo-Artifact ::: action=block ::: message={\"spamScore\":0,\"phishScore\":0,\"threatsInfoMap\":[{\"threatID\":\"2837aa505f82ca7ea16d4d1498940def72b64d002d264d47527a27a34e0c12ff\",\"threatStatus\":\"active\",\"classification\":\"phish\",\"threatUrl\":\"https://threatinsight.proofpoint.com/4a6c87e3-5385-8727-3248-aa120bda900c/threat/email/2837aa505f82ca7ea16d4d1498940def72b64d002d264d47527a27a34e0c12ff\",\"threatTime\":\"2023-06-14T00:41:21.000Z\",\"threat\":\"2837aa505f82ca7ea16d4d1498940def72b64d002d264d47527a27a34e0c12ff\",\"campaignID\":null,\"threatType\":\"attwaynement\"}],\"messageTime\":\"2023-06-14T00:42:36.000Z\",\"impostorScore\":0,\"malwareScore\":0,\"cluster\":\"wayne_hosted\",\"subject\":\"Remittance Advice\",\"quarantineFolder\":\"Attwaynement Defense\",\"quarantineRule\":\"threat\",\"policyRoutes\":[\"default_inbound\",\"wayne_from\"],\"modulesRun\":[\"access\",\"av\",\"zerohour\",\"dkimv\",\"spf\",\"sandbox\",\"spam\",\"dmarc\",\"urldefense\"],\"messageSize\":21183,\"headerFrom\":\"accountspayable@wayne.bank\",\"headerReplyTo\":null,\"fromAddress\":[\"accountspayable@wayne.bank\"],\"ccAddresses\":[],\"replyToAddress\":[],\"toAddresses\":[\"accountspayable@wayne.bank\"],\"xmailer\":null,\"messageParts\":[{\"disposition\":\"inline\",\"sha256\":\"2837aa505f82ca7ea16d4d1498940def72b64d002d264d47527a27a34e0c12ff\",\"md5\":\"fa1d07e4947ed8fd14ea92ba3e2740f3\",\"filename\":\"remittance-advice.html\",\"sandboxStatus\":\"THREAT\",\"oContentType\":\"text/html\",\"contentType\":\"text/html\"}],\"completelyRewritten\":false,\"id\":\"75f72172-e28f-5063-37ac-0c4454248c5f\",\"QID\":\"3r4n1t96ev-1\",\"GUID\":\"mxWwWdMt-u0L_WNPwg6UBYGn1aoEXjMt\",\"sender\":\"bounces+9826919-8cbe-accountspayable=wayne.bank@em7685.derco.cl\",\"recipient\":[\"accountspayable@wayne.bank\"],\"senderIP\":\"151.140.0.138\",\"messageID\":\"<2b39ffaa-9712-e1e0-34b1-eee6a75b0b7c@wayne.bank>\"} ::: fileHash=<2b39ffaa-9712-e1e0-34b1-eee6a75b0b7c@wayne.bank> ::: fileName=from: bounces+9826919-8cbe-accountspayable=wayne.bank@em7685.derco.cl subj: Remittance Advice ::: serverIP=151.140.0.138 ::: emailFrom=bounces+9826919-8cbe-accountspayable=wayne.bank@em7685.derco.cl ::: created_at=2023-06-14T00:42:36.000Z ::: streamName=proofpoint_protect ::: vendorCode=blocked_message ::: messageType=email_protection_event ::: emailSubject=Remittance Advice ::: pipelineName=proofpoint_protect ::: severityCode=2 ::: startTimeUTC=2023-06-14T00:42:36.000Z ::: emailSendingServer=151.140.0.138 ::: pipelineEntrypoint=dispatch",
    "messagetype": "email_protection_event",
    "productids": [
        32
    ],
    "senderhost": "kafka.precinct",
    "sensitivity": "normal",
    "severitycode": 2,
    "severitylabel": "critical",
    "sourceinfo": "unknown",
    "starttimeutc": "2023-06-14T00:42:36.000Z",
    "tags": [
        "proofpoint_protect",
        "email_protection_event"
    ],
    "vendorcode": "blocked_message",
    "streamName": "proofpoint_protect",
    "serverIP": "151.140.0.138"
}