WitFoo-Artifact ::: action=block ::: message={"spamScore":0,"phishScore":100,"threatsInfoMap":[{"threatID":"0055fd0779582a506c67702203a9082a38b646e9c4ad146e187223ddcc5ef3e2","threatStatus":"active","classification":"phish","threatUrl":"https://threatinsight.proofpoint.com/4a6c87e3-5385-8727-3248-aa120bda900c/threat/email/0055fd0779582a506c67702203a9082a38b646e9c4ad146e187223ddcc5ef3e2","threatTime":"2023-01-24T16:45:00.000Z","threat":"0055fd0779582a506c67702203a9082a38b646e9c4ad146e187223ddcc5ef3e2","campaignID":null,"threatType":"attwaynement"}],"messageTime":"2023-01-24T16:45:50.000Z","impostorScore":0,"malwareScore":0,"cluster":"wayne_hosted","subject":"Direct WAYNE Deposit Processed","quarantineFolder":"Attwaynement Defense","quarantineRule":"threat","policyRoutes":["default_inbound","wayne_from"],"modulesRun":["access","av","zerohour","dkimv","spf","sandbox","spam","dmarc","urldefense"],"messageSize":35816,"headerFrom":"wayne® <finance@wayne.bank>","headerReplyTo":null,"fromAddress":["finance@wayne.bank"],"ccAddresses":[],"replyToAddress":[],"toAddresses":["finance@wayne.bank"],"xmailer":null,"messageParts":[{"disposition":"inline","sha256":"0055fd0779582a506c67702203a9082a38b646e9c4ad146e187223ddcc5ef3e2","md5":"c55e9db61d411d1f4cd55653de87dfb7","filename":"depositremittance.html","sandboxStatus":"THREAT","oContentType":"text/html","contentType":"text/html"}],"completelyRewritten":false,"id":"72bad7b1-a10e-cfe0-996b-172a1bb44f55","QID":"3n8faks35t-1","GUID":"kT-NawSdWAVDg8UnCrbM8YSrtGhgEUw3","sender":"bounces+910294-2eb1-finance=wayne.bank@bbb.streampage.com","recipient":["finance@wayne.bank"],"senderIP":"218.179.53.72","messageID":"<4a41492c-31c7-9f03-4b5b-6e01ee02a34b@wayne.bank>"} ::: fileHash=<4a41492c-31c7-9f03-4b5b-6e01ee02a34b@wayne.bank> ::: fileName=from: bounces+910294-2eb1-finance=wayne.bank@bbb.streampage.com subj: Direct WAYNE Deposit Processed ::: serverIP=218.179.53.72 ::: emailFrom=bounces+910294-2eb1-finance=wayne.bank@bbb.streampage.com ::: created_at=2023-01-24T16:45:50.000Z ::: streamName=proofpoint_protect ::: vendorCode=blocked_message ::: messageType=email_protection_event ::: emailSubject=Direct WAYNE Deposit Processed ::: pipelineName=proofpoint_protect ::: severityCode=2 ::: startTimeUTC=2023-01-24T16:45:50.000Z ::: emailSendingServer=218.179.53.72 ::: pipelineEntrypoint=dispatch
This is a syslog message from a product called Protect by ProofPoint. The following fields were extracted from the message:
emailsubject: Direct ACH Deposit Processed
senderhost: localhost
severitylabel: critical
starttimeutc: 2023-01-24T16:45:50.000Z
tags: ['proofpoint_protect', 'email_protection_event']
productids: [32, 0]
filename: from: bounces+910294-2eb1-finance=calprivate.bank@bbb.streampage.com subj: Direct ACH Deposit Processed
severitycode: 2
sensitivity: normal
emailsendingserver: 192.254.117.192
messagetype: email_protection_event
emailfrom: bounces+910294-2eb1-finance=calprivate.bank@bbb.streampage.com
sourceinfo: unknown
filehash: <4a41492c-31c7-9f03-4b5b-6e01ee02a34b@calprivate.bank>
vendorcode: blocked_message
action: block
streamName: proofpoint_protect
serverIP: 218.179.53.72