WitFoo-Artifact ::: action=block ::: message={"spamScore":0,"phishScore":0,"threatsInfoMap":[{"threatID":"03aee25672cbc87ae6924a605211051f3b9ba45bf9a644c044e64fe7b2fa4f07","threatStatus":"active","classification":"phish","threatUrl":"https://threatinsight.proofpoint.com/4a6c87e3-5385-8727-3248-aa120bda900c/threat/email/03aee25672cbc87ae6924a605211051f3b9ba45bf9a644c044e64fe7b2fa4f07","threatTime":"2023-10-26T16:13:32.000Z","threat":"03aee25672cbc87ae6924a605211051f3b9ba45bf9a644c044e64fe7b2fa4f07","campaignID":null,"threatType":"attoscorpment"}],"messageTime":"2023-10-26T16:14:39.000Z","impostorScore":0,"malwareScore":0,"cluster":"oscorp_hosted","subject":"FW: NEW EFT-442389 PMT-RECEIPT-Ccdfi","quarantineFolder":"Attoscorpment Defense","quarantineRule":"threat","policyRoutes":["default_inbound","allow_relay"],"modulesRun":["av","dkimv","spf","sandbox","spam","dmarc","urldefense"],"messageSize":190373,"headerFrom":"Jacqueline Aguilar <jacquelinea@ccdfi.com>","headerReplyTo":null,"fromAddress":["jacquelinea@ccdfi.com"],"ccAddresses":[],"replyToAddress":[],"toAddresses":["loan@ccdfi.com"],"xmailer":null,"messageParts":[{"disposition":"attoscorped","sha256":"03aee25672cbc87ae6924a605211051f3b9ba45bf9a644c044e64fe7b2fa4f07","md5":"44d0ab7332f1a029935bce372fb3c5d5","filename":"employee jacquelinea  d1067554-0000.html","sandboxStatus":"THREAT","oContentType":"text/html","contentType":"text/html"},{"disposition":"inline","sha256":"f032ab3fe4c2a1aa68577e86e927a2fbd6345f7885a3bb78a46aec3789fe1e61","md5":"966b2674e9ff61c72ea242856ff4995c","filename":"text.html","sandboxStatus":"NOT_SUPPORTED","oContentType":"text/html","contentType":"text/html"},{"disposition":"inline","sha256":"0e7da0b480ee472dd3e542oscorp4c6080a0841b17b1f0d593e13fb8132729565c9","md5":"3484bb76ac447d3141c427edcd948261","filename":"text.txt","sandboxStatus":"NOT_SUPPORTED","oContentType":"text/plain","contentType":"text/plain"},{"disposition":"attoscorped","sha256":"b1fbc5c38dd602d4865e97ad9596648ecd00d935bc5875dab0970a6e859982a3","md5":"8ceac3d79daf846749f6438b1fead7af","filename":"image001.jpg","sandboxStatus":"NOT_SUPPORTED","oContentType":"image/jpeg","contentType":"image/jpeg"}],"completelyRewritten":false,"id":"3f7bb408-8c1e-f280-ebe6-534d37fb93dc","QID":"3tvagqj54f-1","GUID":"2o1nUSoNY3WteBC5v0jOjk-Tz-X4XdP8","sender":"jacquelinea@ccdfi.com","recipient":["pdixon@oscorp.bank"],"senderIP":"197.190.96.16","messageID":"<DM6PR16MB3274AC7BA4EFA33028CDD322B8DDA@DM6PR16MB3274.namprd16.prod.outlook.com>"} ::: fileHash=<DM6PR16MB3274AC7BA4EFA33028CDD322B8DDA@DM6PR16MB3274.namprd16.prod.outlook.com> ::: fileName=from: jacquelinea@ccdfi.com subj: FW: NEW EFT-442389 PMT-RECEIPT-Ccdfi ::: serverIP=197.190.96.16 ::: emailFrom=jacquelinea@ccdfi.com ::: created_at=2023-10-26T16:14:39.000Z ::: streamName=proofpoint_protect ::: vendorCode=blocked_message ::: messageType=email_protection_event ::: emailSubject=FW: NEW EFT-442389 PMT-RECEIPT-Ccdfi ::: pipelineName=proofpoint_protect ::: severityCode=2 ::: startTimeUTC=2023-10-26T16:14:39.000Z ::: emailSendingServer=197.190.96.16 ::: pipelineEntrypoint=dispatch
{
    "action": "block",
    "emailfrom": "jacquelinea@ccdfi.com",
    "emailsendingserver": "40.107.237.126",
    "emailsubject": "FW: NEW EFT-442389 PMT-RECEIPT-Ccdfi",
    "filehash": "<DM6PR16MB3274AC7BA4EFA33028CDD322B8DDA@DM6PR16MB3274.namprd16.prod.outlook.com>",
    "filename": "from: jacquelinea@ccdfi.com subj: FW: NEW EFT-442389 PMT-RECEIPT-Ccdfi",
    "message": "WitFoo-Artifact ::: action=block ::: message={\"spamScore\":0,\"phishScore\":0,\"threatsInfoMap\":[{\"threatID\":\"03aee25672cbc87ae6924a605211051f3b9ba45bf9a644c044e64fe7b2fa4f07\",\"threatStatus\":\"active\",\"classification\":\"phish\",\"threatUrl\":\"https://threatinsight.proofpoint.com/4a6c87e3-5385-8727-3248-aa120bda900c/threat/email/03aee25672cbc87ae6924a605211051f3b9ba45bf9a644c044e64fe7b2fa4f07\",\"threatTime\":\"2023-10-26T16:13:32.000Z\",\"threat\":\"03aee25672cbc87ae6924a605211051f3b9ba45bf9a644c044e64fe7b2fa4f07\",\"campaignID\":null,\"threatType\":\"attoscorpment\"}],\"messageTime\":\"2023-10-26T16:14:39.000Z\",\"impostorScore\":0,\"malwareScore\":0,\"cluster\":\"oscorp_hosted\",\"subject\":\"FW: NEW EFT-442389 PMT-RECEIPT-Ccdfi\",\"quarantineFolder\":\"Attoscorpment Defense\",\"quarantineRule\":\"threat\",\"policyRoutes\":[\"default_inbound\",\"allow_relay\"],\"modulesRun\":[\"av\",\"dkimv\",\"spf\",\"sandbox\",\"spam\",\"dmarc\",\"urldefense\"],\"messageSize\":190373,\"headerFrom\":\"Jacqueline Aguilar <jacquelinea@ccdfi.com>\",\"headerReplyTo\":null,\"fromAddress\":[\"jacquelinea@ccdfi.com\"],\"ccAddresses\":[],\"replyToAddress\":[],\"toAddresses\":[\"loan@ccdfi.com\"],\"xmailer\":null,\"messageParts\":[{\"disposition\":\"attoscorped\",\"sha256\":\"03aee25672cbc87ae6924a605211051f3b9ba45bf9a644c044e64fe7b2fa4f07\",\"md5\":\"44d0ab7332f1a029935bce372fb3c5d5\",\"filename\":\"employee jacquelinea  d1067554-0000.html\",\"sandboxStatus\":\"THREAT\",\"oContentType\":\"text/html\",\"contentType\":\"text/html\"},{\"disposition\":\"inline\",\"sha256\":\"f032ab3fe4c2a1aa68577e86e927a2fbd6345f7885a3bb78a46aec3789fe1e61\",\"md5\":\"966b2674e9ff61c72ea242856ff4995c\",\"filename\":\"text.html\",\"sandboxStatus\":\"NOT_SUPPORTED\",\"oContentType\":\"text/html\",\"contentType\":\"text/html\"},{\"disposition\":\"inline\",\"sha256\":\"0e7da0b480ee472dd3e542oscorp4c6080a0841b17b1f0d593e13fb8132729565c9\",\"md5\":\"3484bb76ac447d3141c427edcd948261\",\"filename\":\"text.txt\",\"sandboxStatus\":\"NOT_SUPPORTED\",\"oContentType\":\"text/plain\",\"contentType\":\"text/plain\"},{\"disposition\":\"attoscorped\",\"sha256\":\"b1fbc5c38dd602d4865e97ad9596648ecd00d935bc5875dab0970a6e859982a3\",\"md5\":\"8ceac3d79daf846749f6438b1fead7af\",\"filename\":\"image001.jpg\",\"sandboxStatus\":\"NOT_SUPPORTED\",\"oContentType\":\"image/jpeg\",\"contentType\":\"image/jpeg\"}],\"completelyRewritten\":false,\"id\":\"3f7bb408-8c1e-f280-ebe6-534d37fb93dc\",\"QID\":\"3tvagqj54f-1\",\"GUID\":\"2o1nUSoNY3WteBC5v0jOjk-Tz-X4XdP8\",\"sender\":\"jacquelinea@ccdfi.com\",\"recipient\":[\"pdixon@oscorp.bank\"],\"senderIP\":\"197.190.96.16\",\"messageID\":\"<DM6PR16MB3274AC7BA4EFA33028CDD322B8DDA@DM6PR16MB3274.namprd16.prod.outlook.com>\"} ::: fileHash=<DM6PR16MB3274AC7BA4EFA33028CDD322B8DDA@DM6PR16MB3274.namprd16.prod.outlook.com> ::: fileName=from: jacquelinea@ccdfi.com subj: FW: NEW EFT-442389 PMT-RECEIPT-Ccdfi ::: serverIP=197.190.96.16 ::: emailFrom=jacquelinea@ccdfi.com ::: created_at=2023-10-26T16:14:39.000Z ::: streamName=proofpoint_protect ::: vendorCode=blocked_message ::: messageType=email_protection_event ::: emailSubject=FW: NEW EFT-442389 PMT-RECEIPT-Ccdfi ::: pipelineName=proofpoint_protect ::: severityCode=2 ::: startTimeUTC=2023-10-26T16:14:39.000Z ::: emailSendingServer=197.190.96.16 ::: pipelineEntrypoint=dispatch",
    "messagetype": "email_protection_event",
    "productids": [
        32
    ],
    "senderhost": "kafka.precinct",
    "sensitivity": "normal",
    "severitycode": 2,
    "severitylabel": "critical",
    "sourceinfo": "unknown",
    "starttimeutc": "2023-10-26T16:14:39.000Z",
    "tags": [
        "proofpoint_protect",
        "email_protection_event"
    ],
    "vendorcode": "blocked_message",
    "streamName": "proofpoint_protect",
    "serverIP": "197.190.96.16"
}