WitFoo-Artifact ::: action=block ::: message={"spamScore":100,"phishScore":100,"threatsInfoMap":[{"threatID":"d931e52db57bd8caa2b124770033e5419a351b504e8c12e8cfac02f3fff1f165","threatStatus":"active","classification":"phish","threatUrl":"https://threatinsight.proofpoint.com/4a6c87e3-5385-8727-3248-aa120bda900c/threat/email/d931e52db57bd8caa2b124770033e5419a351b504e8c12e8cfac02f3fff1f165","threatTime":"2023-09-12T18:22:58.000Z","threat":"r20.rs6.net////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////tn.jsp?f=001WQxnG0tSXccIQ-e7Yc6HIceYJlhri4NkC8Kbu82vJflmU1eq_NKX8RE1IuCBhf4q3vhifcar28mByO6PmH458IdOywhcBRxp_tmmiosW9KCQkrkyywSL22gbTBWE0-CVtqXmQkJ_UStUXubB_pUemp-WdZiK1MALfG4R73wuqTbXwRPwik6HaS4wh6S-AmQY86-rda6CWzJ915Iml1AryA==","campaignID":null,"threatType":"url"},{"threatID":"07633fb931c3b980b25ea5a796fc85ef7c41fac88ddc978227fc58d5d19c2268","threatStatus":"active","classification":"phish","threatUrl":"https://threatinsight.proofpoint.com/4a6c87e3-5385-8727-3248-aa120bda900c/threat/email/07633fb931c3b980b25ea5a796fc85ef7c41fac88ddc978227fc58d5d19c2268","threatTime":"2023-09-12T18:21:40.000Z","threat":"r20.rs6.net////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////tn.jsp?f=001WQxnG0tSXccIQ-e7Yc6HIceYJlhri4NkC8Kbu82vJflmU1eq_NKX8RE1IuCBhf4q3vhifcar28mByO6PmH458IdOywhcBRxp_tmmiosW9KCQkrkyywSL22gbTBWE0-CVtqXmQkJ_UStUXubB_pUemp-WdZiK1MALfG4R73wuqTbXwRPwik6HaS4wh6S-AmQY86-rda6CWzJ915Iml1AryA==&c=eUyM-4DhdP-5_eiNDQATcA3YSSuMQhu7QeOaQyhbiQ426lCkeGlBKQ==&ch=B6K52ajSh_VBHYAqF16gmI5mcdcAI7jbSuB7HqWFy5hSkyc5V4VP4w==","campaignID":null,"threatType":"url"},{"threatID":"47a349b063a3bb4ea71f304bf88eee37ecb1c0034bfd31fbb631ce2af30d29c1","threatStatus":"active","classification":"phish","threatUrl":"https://threatinsight.proofpoint.com/4a6c87e3-5385-8727-3248-aa120bda900c/threat/email/47a349b063a3bb4ea71f304bf88eee37ecb1c0034bfd31fbb631ce2af30d29c1","threatTime":"2023-09-12T18:22:23.000Z","threat":"http://r20.rs6.net//////%5C%5C%5C%5C%5C%5C///////%5C%5C%5C%5C%5C%5C////////%5C%5C%5C%5C%5C%5C%5C////////%5C%5C%5C%5C%5C%5C%5C//////%5C%5C%5C%5C%5C%5C%5C%5C////////%5C%5C%5C%5C%5C%5C%5C%5C%5C/////////////%5C%5C%5C%5C%5C%5C%5C%5C%5C/////////////////%5C%5C%5C%5C%5C%5C%5C%5C%5C%5C%5C%5C/%5C/%5C%5C/%5C/%5C%5C%5C%5C%5C%5C%5C%5C%5C%5C%5C%5C%5C%5C%5C%5C%5C%5C%5C%5C%5C%5C%5C%5C%5C%5C%5C%5C%5C%5C%5C%5C%5C%5C%5C%5C%5C%5C%5C%5C%5C%5C%5C%5C%5C%5C%5C%5C%5C%5C%5C%5C%5C%5C%5C%5C%5C%5C%5C%5C%5C%5C%5C%5C%5C%5C%5C%5C%5C%5C%5C%5C%5C%5C%5C%5C%5C%5C%5C%5C%5C%5C%5C%5C%5C%5C%5C%5C%5C%5C%5C%5C%5C%5C%5C%5C%5C%5C%5C%5C%5C%5C%5C%5C%5C%5C%5C%5C%5C%5C%5C%5C%5C%5C%5C%5C%5C%5C%5C%5C%5C%5C%5C%5C%5C%5C%5C%5C%5C%5C%5C%5C%5C%5C%5C%5C%5C%5C%5C%5C%5C%5C%5C%5C%5C%5C%5C%5C%5C%5C%5C%5C%5C%5C%5C%5C%5C%5C%5C%5C%5C%5C%5C%5C%5C%5C%5C%5C%5C%5C%5C%5C%5C///////////////////////////////////////////////////////////////////////////////////////////%5C%5C%5C%5C%5C%5C%5C%5C%5C%5C%5C%5C%5C%5C%5C%5C%5C%5C%5C%5C%5C%5C%5C%5C%5C%5C%5Ctn.jsp?f=001WQxnG0tSXccIQ-e7Yc6HIceYJlhri4NkC8Kbu82vJflmU1eq_NKX8RE1IuCBhf4q3vhifcar28mByO6PmH458IdOywhcBRxp_tmmiosW9KCQkrkyywSL22gbTBWE0-CVtqXmQkJ_UStUXubB_pUemp-WdZiK1MALfG4R73wuqTbXwRPwik6HaS4wh6S-AmQY86-rda6CWzJ915Iml1AryA==&c=eUyM-4DhdP-5_eiNDQATcA3YSSuMQhu7QeOaQyhbiQ426lCkeGlBKQ==&ch=B6K52ajSh_VBHYAqF16gmI5mcdcAI7jbSuB7HqWFy5hSkyc5V4VP4w==","campaignID":null,"threatType":"url"}],"messageTime":"2023-09-12T20:05:34.000Z","impostorScore":0,"malwareScore":0,"cluster":"oscorp_hosted","subject":"Storage Review: Memory Full","quarantineFolder":"Phish","quarantineRule":"inbound_phish","policyRoutes":["default_inbound"],"modulesRun":["av","dkimv","spf","spam","dmarc","pdr","urldefense"],"messageSize":22436,"headerFrom":"eServices<zeruchat@appstate.edu>","headerReplyTo":null,"fromAddress":["zeruchat@appstate.edu"],"ccAddresses":[],"replyToAddress":[],"toAddresses":["rsowers@oscorp.bank"],"xmailer":null,"messageParts":[{"disposition":"inline","sha256":"9b86ede780cfc11daa463c196b1b0499a390fda6cb6efafeb7470757f69fa362","md5":"3923cf195e578b45ffd5335513a3e224","filename":"text.html","sandboxStatus":null,"oContentType":"text/html","contentType":"text/html"},{"disposition":"attoscorped","sha256":"fa11e9be2333a04991014c5e857f5b208f791c7eecbc7fc04addfddc20dedaef","md5":"d7880341674d09ac05af08a898e7e8e1","filename":"3363193.png","sandboxStatus":null,"oContentType":"image/png","contentType":"image/png"}],"completelyRewritten":false,"id":"7f50520f-2659-c995-babf-721e15f9bccd","QID":"3t2rjt8611-1","GUID":"FRxgefOywVFjNClGQPhg-uOMrBxAHKID","sender":"zeruchat@appstate.edu","recipient":["rsowers@oscorp.bank"],"senderIP":"6.114.198.3","messageID":"<3t2rjt8611-1@m0162927.ppops.net>"} ::: fileHash=<3t2rjt8611-1@m0162927.ppops.net> ::: fileName=from: zeruchat@appstate.edu subj: Storage Review: Memory Full ::: serverIP=6.114.198.3 ::: emailFrom=zeruchat@appstate.edu ::: created_at=2023-09-12T20:05:34.000Z ::: streamName=proofpoint_protect ::: vendorCode=blocked_message ::: messageType=email_protection_event ::: emailSubject=Storage Review: Memory Full ::: pipelineName=proofpoint_protect ::: severityCode=2 ::: startTimeUTC=2023-09-12T20:05:34.000Z ::: emailSendingServer=6.114.198.3 ::: pipelineEntrypoint=dispatch
This is a syslog message from a product called Protect by ProofPoint. The following fields were extracted from the message:
action: block
emailfrom: zeruchat@appstate.edu
emailsendingserver: 152.10.1.152
emailsubject: Storage Review: Memory Full
filehash: <3t2rjt8611-1@m0162927.ppops.net>
filename: from: zeruchat@appstate.edu subj: Storage Review: Memory Full
messagetype: email_protection_event
productids: [32]
senderhost: kafka.precinct
sensitivity: normal
severitycode: 2
severitylabel: critical
sourceinfo: unknown
starttimeutc: 2023-09-12T20:05:34.000Z
tags: ['proofpoint_protect', 'email_protection_event']
vendorcode: blocked_message
streamName: proofpoint_protect
serverIP: 6.114.198.3