Initial commit - 611 cybersecurity skills across all subdomains

skills/implementing-email-sandboxing-with-proofpoint/SKILL.md

@@ -0,0 +1,85 @@
+---
+name: implementing-email-sandboxing-with-proofpoint
+description: Email sandboxing detonates suspicious attachments and URLs in isolated environments to detect zero-day malware and evasive phishing payloads. Proofpoint Targeted Attack Protection (TAP) is an industry
+domain: cybersecurity
+subdomain: phishing-defense
+tags: [phishing, email-security, social-engineering, dmarc, awareness, sandboxing, proofpoint]
+version: "1.0"
+author: mahipal
+license: MIT
+---
+# Implementing Email Sandboxing with Proofpoint
+
+## Overview
+Email sandboxing detonates suspicious attachments and URLs in isolated environments to detect zero-day malware and evasive phishing payloads. Proofpoint Targeted Attack Protection (TAP) is an industry-leading solution that uses multi-stage sandboxing, URL rewriting, and predictive analysis. This skill covers configuring Proofpoint TAP, integrating with email flow, analyzing sandbox reports, and tuning detection policies.
+
+## Prerequisites
+- Proofpoint Email Protection license with TAP add-on
+- Admin access to Proofpoint admin console
+- Understanding of email delivery architecture (MX records, mail flow rules)
+- SIEM integration capability
+
+## Key Concepts
+
+### Proofpoint TAP Capabilities
+1. **Attachment sandboxing**: Detonates files in virtual machines (Windows, macOS, Android)
+2. **URL Defense**: Rewrites URLs, detonates at time-of-click
+3. **Threat Intelligence**: Proofpoint's NexusAI threat intelligence integration
+4. **TAP Dashboard**: Real-time visibility into threats targeting the organization
+5. **Campaign correlation**: Groups related attacks into campaigns
+6. **Very Attacked People (VAP)**: Identifies most-targeted individuals
+
+### Sandbox Evasion Techniques Detected
+- Delayed execution (time-bomb malware)
+- VM detection bypass
+- User interaction requirements (click-to-enable macros)
+- Sandbox-aware malware that checks for analysis environment
+- Encrypted/password-protected attachments
+- Multi-stage payloads with delayed C2 retrieval
+
+## Implementation Steps
+
+### Step 1: Configure TAP in Proofpoint
+- Enable TAP for inbound email policy
+- Configure sandbox profiles (attachment types to detonate)
+- Set URL Defense rewriting policy
+- Configure quarantine actions for malicious verdicts
+
+### Step 2: Tune Attachment Policies
+```
+Recommended attachment policy:
+- Detonate: .exe, .dll, .scr, .doc(m), .xls(m), .ppt(m), .pdf, .zip, .rar, .7z, .iso
+- Block without detonation: .bat, .cmd, .ps1, .vbs, .js, .wsf, .hta
+- Password-protected archives: Attempt common passwords, then quarantine
+- Dynamic delivery: Deliver email body, hold attachment until verdict
+```
+
+### Step 3: Configure URL Defense
+- Enable URL rewriting for all inbound email
+- Set time-of-click detonation
+- Block access to malicious URLs
+- Show warning page for suspicious (not confirmed malicious) URLs
+- Configure allowed domains bypass list
+
+### Step 4: Set Up TAP Dashboard Monitoring
+- Configure daily threat digest emails to security team
+- Set up real-time alerts for targeted attacks
+- Monitor VAP report for high-risk users
+- Review campaign clusters for coordinated attacks
+
+### Step 5: Integrate with SIEM
+- Configure syslog/API export to SIEM
+- Create correlation rules for TAP alerts
+- Set up automated response workflows
+
+## Tools & Resources
+- **Proofpoint TAP**: https://www.proofpoint.com/us/products/advanced-threat-protection
+- **Proofpoint TAP Dashboard**: https://threatinsight.proofpoint.com/
+- **Proofpoint API**: https://help.proofpoint.com/Threat_Insight_Dashboard/API_Documentation
+- **Proofpoint Community**: https://community.proofpoint.com/
+
+## Validation
+- Attachment detonation catches EICAR test file and macro-enabled document
+- URL Defense rewrites and blocks known phishing URLs
+- TAP Dashboard displays threat summary
+- SIEM receives and alerts on TAP events

skills/implementing-email-sandboxing-with-proofpoint/assets/template.md

@@ -0,0 +1,34 @@
+# Email Sandboxing Configuration Template (Proofpoint TAP)
+
+## Deployment Info
+- **Product**: Proofpoint Email Protection + TAP
+- **Deployment Date**: [YYYY-MM-DD]
+- **MX Records Updated**: Yes/No
+- **SIEM Integration**: [Splunk / Sentinel / QRadar]
+
+## Attachment Sandbox Policy
+| File Type | Action | Sandbox Env | Timeout |
+|---|---|---|---|
+| .exe, .dll, .scr | Detonate + Block | Win10, Win11 | 120s |
+| .doc(m), .xls(m), .ppt(m) | Detonate (dynamic delivery) | Win10 + Office | 90s |
+| .pdf | Detonate | Win10 + Reader | 60s |
+| .zip, .rar, .7z | Extract + Detonate contents | All | 120s |
+| .iso, .img | Detonate | Win10 | 120s |
+| .js, .vbs, .ps1, .bat | Block (no detonation) | N/A | N/A |
+
+## URL Defense Policy
+| Setting | Value |
+|---|---|
+| URL rewriting | All inbound email |
+| Time-of-click analysis | Enabled |
+| Block malicious URLs | Yes |
+| Suspicious URL interstitial | Enabled |
+| Allowed domains bypass | [list internal domains] |
+
+## Monitoring Checklist
+- [ ] Daily: Review TAP Dashboard threat digest
+- [ ] Daily: Check quarantine for false positives
+- [ ] Weekly: Review VAP list
+- [ ] Weekly: Analyze threat trends
+- [ ] Monthly: Generate executive threat report
+- [ ] Quarterly: Policy tuning review

skills/implementing-email-sandboxing-with-proofpoint/references/standards.md

@@ -0,0 +1,34 @@
+# Standards & References: Email Sandboxing with Proofpoint
+
+## MITRE ATT&CK Coverage
+- **T1566.001**: Phishing: Spearphishing Attachment (primary detection)
+- **T1566.002**: Phishing: Spearphishing Link (URL Defense)
+- **T1204.001/002**: User Execution: Malicious Link/File
+- **T1059**: Command and Scripting Interpreter (macro detection)
+- **T1027**: Obfuscated Files or Information
+
+## NIST Guidelines
+- **NIST SP 800-177**: Trustworthy Email - attachment security
+- **NIST SP 800-83 Rev.1**: Guide to Malware Incident Prevention
+- **NIST SP 800-53**: SI-3 Malicious Code Protection, SI-8 Spam Protection
+
+## Proofpoint TAP API Endpoints
+| Endpoint | Description |
+|---|---|
+| `/v2/siem/all` | All threat events for SIEM |
+| `/v2/siem/messages/blocked` | Blocked message events |
+| `/v2/siem/messages/delivered` | Delivered message events with threats |
+| `/v2/siem/clicks/blocked` | Blocked URL click events |
+| `/v2/siem/clicks/permitted` | Permitted URL click events |
+| `/v2/people/vap` | Very Attacked People list |
+| `/v2/campaign/{id}` | Campaign details |
+
+## Sandbox File Types
+| Category | Extensions | Action |
+|---|---|---|
+| Executables | .exe, .dll, .scr, .com | Detonate + Block |
+| Office docs | .doc(x/m), .xls(x/m), .ppt(x/m) | Detonate |
+| PDF | .pdf | Detonate |
+| Archives | .zip, .rar, .7z, .tar.gz | Extract + Detonate |
+| Scripts | .js, .vbs, .ps1, .bat, .cmd | Block |
+| Disk images | .iso, .img, .vhd | Detonate |

skills/implementing-email-sandboxing-with-proofpoint/references/workflows.md

@@ -0,0 +1,69 @@
+# Workflows: Email Sandboxing with Proofpoint
+
+## Workflow 1: Attachment Detonation Pipeline
+```
+Email with attachment arrives at Proofpoint gateway
+  |
+  v
+[Pre-filter: Check attachment type]
+  +-- Blocked types (.bat, .ps1, .vbs) --> Quarantine immediately
+  +-- Detonable types --> Send to sandbox
+  +-- Known safe types (.txt, .csv) --> Deliver
+  |
+  v
+[Sandbox detonation]
+  +-- Execute in multiple environments (Win10, Win11, macOS)
+  +-- Monitor: file system changes, registry, network, process creation
+  +-- Timeout: 60-120 seconds per environment
+  |
+  v
+[Verdict]
+  +-- MALICIOUS --> Quarantine, alert, extract IOCs
+  +-- SUSPICIOUS --> Quarantine for analyst review
+  +-- CLEAN --> Deliver with dynamic delivery
+```
+
+## Workflow 2: URL Defense Time-of-Click
+```
+Email with URL arrives
+  |
+  v
+[URL rewritten to Proofpoint URL Defense proxy]
+  |
+  v
+[Email delivered to user]
+  |
+  v
+[User clicks rewritten URL]
+  |
+  v
+[Proofpoint performs real-time analysis]
+  +-- Reputation check
+  +-- Content analysis
+  +-- Sandbox detonation of landing page
+  |
+  +-- SAFE --> Redirect to original URL
+  +-- MALICIOUS --> Block access, show warning page
+  +-- SUSPICIOUS --> Show interstitial warning, allow proceed
+```
+
+## Workflow 3: TAP Dashboard Monitoring
+```
+Daily operations:
+  +-- Review TAP Dashboard threat digest
+  +-- Check VAP (Very Attacked People) changes
+  +-- Review campaign clusters
+  +-- Investigate quarantined messages
+  +-- Monitor false positive rate
+  |
+Weekly:
+  +-- Analyze threat trends
+  +-- Review sandboxing effectiveness
+  +-- Tune policies based on FP/FN data
+  +-- Update blocked file type list
+  |
+Monthly:
+  +-- Generate executive report from TAP
+  +-- Review VAP list with HR/management
+  +-- Assess ROI and threat prevention metrics
+```

skills/implementing-email-sandboxing-with-proofpoint/scripts/process.py

@@ -0,0 +1,241 @@
+#!/usr/bin/env python3
+"""
+Proofpoint TAP API Integration and Analysis
+
+Pulls threat data from Proofpoint TAP SIEM API, analyzes sandbox results,
+identifies Very Attacked People, and generates threat reports.
+
+Usage:
+    python process.py threats --hours 24
+    python process.py vap
+    python process.py campaign --id <campaign-id>
+    python process.py report --hours 168 --output report.html
+"""
+
+import argparse
+import json
+import sys
+import os
+from datetime import datetime, timezone, timedelta
+from collections import defaultdict
+from dataclasses import dataclass, field, asdict
+
+try:
+    import requests
+    HAS_REQUESTS = True
+except ImportError:
+    HAS_REQUESTS = False
+
+PP_SERVICE_PRINCIPAL = os.environ.get("PP_SERVICE_PRINCIPAL", "")
+PP_SECRET = os.environ.get("PP_SECRET", "")
+PP_BASE_URL = "https://tap-api-v2.proofpoint.com"
+
+
+class ProofpointTAPClient:
+    """Client for Proofpoint TAP SIEM API."""
+
+    def __init__(self, principal: str, secret: str):
+        self.auth = (principal, secret)
+        self.base = PP_BASE_URL
+
+    def _get(self, endpoint: str, params: dict = None) -> dict:
+        resp = requests.get(f"{self.base}{endpoint}",
+                            auth=self.auth, params=params, timeout=30)
+        resp.raise_for_status()
+        return resp.json()
+
+    def get_all_threats(self, since_seconds: int = 3600) -> dict:
+        params = {"sinceSeconds": since_seconds, "format": "json"}
+        return self._get("/v2/siem/all", params)
+
+    def get_blocked_messages(self, since_seconds: int = 3600) -> dict:
+        params = {"sinceSeconds": since_seconds, "format": "json"}
+        return self._get("/v2/siem/messages/blocked", params)
+
+    def get_delivered_threats(self, since_seconds: int = 3600) -> dict:
+        params = {"sinceSeconds": since_seconds, "format": "json"}
+        return self._get("/v2/siem/messages/delivered", params)
+
+    def get_blocked_clicks(self, since_seconds: int = 3600) -> dict:
+        params = {"sinceSeconds": since_seconds, "format": "json"}
+        return self._get("/v2/siem/clicks/blocked", params)
+
+    def get_permitted_clicks(self, since_seconds: int = 3600) -> dict:
+        params = {"sinceSeconds": since_seconds, "format": "json"}
+        return self._get("/v2/siem/clicks/permitted", params)
+
+    def get_vap(self, window: int = 14) -> dict:
+        params = {"window": window}
+        return self._get("/v2/people/vap", params)
+
+    def get_campaign(self, campaign_id: str) -> dict:
+        return self._get(f"/v2/campaign/{campaign_id}")
+
+
+def analyze_threats(threat_data: dict) -> dict:
+    """Analyze threat data and produce summary statistics."""
+    messages_blocked = threat_data.get("messagesBlocked", [])
+    messages_delivered = threat_data.get("messagesDelivered", [])
+    clicks_blocked = threat_data.get("clicksBlocked", [])
+    clicks_permitted = threat_data.get("clicksPermitted", [])
+
+    # Threat classification counts
+    threat_types = defaultdict(int)
+    threat_families = defaultdict(int)
+    targeted_users = defaultdict(int)
+    sender_domains = defaultdict(int)
+
+    all_messages = messages_blocked + messages_delivered
+    for msg in all_messages:
+        for threat in msg.get("threatsInfoMap", []):
+            threat_types[threat.get("classification", "unknown")] += 1
+            if threat.get("threatType") == "attachment":
+                threat_families[threat.get("threat", "unknown")] += 1
+
+        for recipient in msg.get("recipient", []) if isinstance(msg.get("recipient"), list) else [msg.get("recipient", "")]:
+            if recipient:
+                targeted_users[recipient] += 1
+
+        sender = msg.get("senderDomain", msg.get("fromAddress", ""))
+        if sender:
+            sender_domains[sender] += 1
+
+    summary = {
+        "total_messages_blocked": len(messages_blocked),
+        "total_messages_delivered_with_threats": len(messages_delivered),
+        "total_clicks_blocked": len(clicks_blocked),
+        "total_clicks_permitted": len(clicks_permitted),
+        "threat_type_breakdown": dict(threat_types),
+        "top_threat_families": dict(sorted(threat_families.items(),
+                                           key=lambda x: x[1], reverse=True)[:10]),
+        "top_targeted_users": dict(sorted(targeted_users.items(),
+                                          key=lambda x: x[1], reverse=True)[:10]),
+        "top_sender_domains": dict(sorted(sender_domains.items(),
+                                          key=lambda x: x[1], reverse=True)[:10]),
+    }
+    return summary
+
+
+def format_threat_report(summary: dict, hours: int) -> str:
+    """Format threat summary as text report."""
+    lines = []
+    lines.append("=" * 60)
+    lines.append("  PROOFPOINT TAP THREAT REPORT")
+    lines.append("=" * 60)
+    lines.append(f"  Period: Last {hours} hours")
+    lines.append(f"  Generated: {datetime.now(timezone.utc).strftime('%Y-%m-%d %H:%M UTC')}")
+    lines.append("")
+
+    lines.append("[OVERVIEW]")
+    lines.append(f"  Messages Blocked:           {summary['total_messages_blocked']}")
+    lines.append(f"  Delivered with Threats:      {summary['total_messages_delivered_with_threats']}")
+    lines.append(f"  Clicks Blocked:              {summary['total_clicks_blocked']}")
+    lines.append(f"  Clicks Permitted:            {summary['total_clicks_permitted']}")
+    lines.append("")
+
+    if summary["threat_type_breakdown"]:
+        lines.append("[THREAT TYPES]")
+        for t, count in sorted(summary["threat_type_breakdown"].items(),
+                                key=lambda x: x[1], reverse=True):
+            lines.append(f"  {t}: {count}")
+        lines.append("")
+
+    if summary["top_targeted_users"]:
+        lines.append("[MOST TARGETED USERS]")
+        for user, count in list(summary["top_targeted_users"].items())[:10]:
+            lines.append(f"  {user}: {count} threats")
+        lines.append("")
+
+    if summary["top_sender_domains"]:
+        lines.append("[TOP THREAT SENDER DOMAINS]")
+        for domain, count in list(summary["top_sender_domains"].items())[:10]:
+            lines.append(f"  {domain}: {count}")
+
+    lines.append("=" * 60)
+    return "\n".join(lines)
+
+
+def main():
+    parser = argparse.ArgumentParser(description="Proofpoint TAP Analysis")
+    subparsers = parser.add_subparsers(dest="command")
+
+    threats_parser = subparsers.add_parser("threats", help="Get recent threats")
+    threats_parser.add_argument("--hours", type=int, default=24)
+
+    vap_parser = subparsers.add_parser("vap", help="Get Very Attacked People")
+    vap_parser.add_argument("--window", type=int, default=14, help="Days to look back")
+
+    campaign_parser = subparsers.add_parser("campaign", help="Get campaign details")
+    campaign_parser.add_argument("--id", required=True)
+
+    report_parser = subparsers.add_parser("report", help="Generate threat report")
+    report_parser.add_argument("--hours", type=int, default=168)
+    report_parser.add_argument("--output", "-o")
+
+    parser.add_argument("--json", action="store_true")
+    parser.add_argument("--principal", default=PP_SERVICE_PRINCIPAL)
+    parser.add_argument("--secret", default=PP_SECRET)
+
+    args = parser.parse_args()
+
+    if not HAS_REQUESTS:
+        print("Error: requests library required", file=sys.stderr)
+        sys.exit(1)
+
+    principal = args.principal
+    secret = args.secret
+
+    if not principal or not secret:
+        print("Error: Proofpoint TAP credentials required.", file=sys.stderr)
+        print("Set PP_SERVICE_PRINCIPAL and PP_SECRET environment variables.", file=sys.stderr)
+        sys.exit(1)
+
+    client = ProofpointTAPClient(principal, secret)
+
+    if args.command == "threats":
+        seconds = args.hours * 3600
+        data = client.get_all_threats(seconds)
+        summary = analyze_threats(data)
+        if args.json:
+            print(json.dumps(summary, indent=2))
+        else:
+            print(format_threat_report(summary, args.hours))
+
+    elif args.command == "vap":
+        data = client.get_vap(args.window)
+        users = data.get("users", [])
+        print(f"Very Attacked People (last {args.window} days):")
+        for user in users:
+            identity = user.get("identity", {})
+            print(f"  {identity.get('emails', [''])[0]} - "
+                  f"Attacks: {user.get('threatStatistics', {}).get('attackIndex', 0)}")
+
+    elif args.command == "campaign":
+        data = client.get_campaign(args.id)
+        if args.json:
+            print(json.dumps(data, indent=2))
+        else:
+            print(f"Campaign: {data.get('name', 'Unknown')}")
+            print(f"Description: {data.get('description', '')}")
+            actors = data.get("actors", [])
+            for actor in actors:
+                print(f"  Actor: {actor.get('name', 'Unknown')}")
+
+    elif args.command == "report":
+        seconds = args.hours * 3600
+        data = client.get_all_threats(seconds)
+        summary = analyze_threats(data)
+        report = format_threat_report(summary, args.hours)
+        if args.output:
+            with open(args.output, "w") as f:
+                f.write(report)
+            print(f"Report written to {args.output}")
+        else:
+            print(report)
+
+    else:
+        parser.print_help()
+
+
+if __name__ == "__main__":
+    main()