Initial commit - 611 cybersecurity skills across all subdomains

skills/implementing-email-sandboxing-with-proofpoint/references/standards.md

@@ -0,0 +1,34 @@
+# Standards & References: Email Sandboxing with Proofpoint
+
+## MITRE ATT&CK Coverage
+- **T1566.001**: Phishing: Spearphishing Attachment (primary detection)
+- **T1566.002**: Phishing: Spearphishing Link (URL Defense)
+- **T1204.001/002**: User Execution: Malicious Link/File
+- **T1059**: Command and Scripting Interpreter (macro detection)
+- **T1027**: Obfuscated Files or Information
+
+## NIST Guidelines
+- **NIST SP 800-177**: Trustworthy Email - attachment security
+- **NIST SP 800-83 Rev.1**: Guide to Malware Incident Prevention
+- **NIST SP 800-53**: SI-3 Malicious Code Protection, SI-8 Spam Protection
+
+## Proofpoint TAP API Endpoints
+| Endpoint | Description |
+|---|---|
+| `/v2/siem/all` | All threat events for SIEM |
+| `/v2/siem/messages/blocked` | Blocked message events |
+| `/v2/siem/messages/delivered` | Delivered message events with threats |
+| `/v2/siem/clicks/blocked` | Blocked URL click events |
+| `/v2/siem/clicks/permitted` | Permitted URL click events |
+| `/v2/people/vap` | Very Attacked People list |
+| `/v2/campaign/{id}` | Campaign details |
+
+## Sandbox File Types
+| Category | Extensions | Action |
+|---|---|---|
+| Executables | .exe, .dll, .scr, .com | Detonate + Block |
+| Office docs | .doc(x/m), .xls(x/m), .ppt(x/m) | Detonate |
+| PDF | .pdf | Detonate |
+| Archives | .zip, .rar, .7z, .tar.gz | Extract + Detonate |
+| Scripts | .js, .vbs, .ps1, .bat, .cmd | Block |
+| Disk images | .iso, .img, .vhd | Detonate |