Abnormal Abuse Mailbox: Save Time with AI-Driven Auto-Remediation of Employee-Reported Phishing Emails

December 17, 2020

For SOC analysts, managing an employee-reported phishing mailbox can be a double-edged sword. On one hand, legacy tools have made it easy for employees to report would-be business email compromise (BEC) and credential phishing emails. On the other hand, analysts spend a significant amount of time manually monitoring and determining if messages are safe or if they need remediating, creating a resource bottleneck.

In many cases, it can take minutes to over an hour to understand the implications behind a phishing report.

Understanding the Phishing Mailbox Workflow

A common phishing mailbox workflow goes like this:

  1. An employee reports a phishing email to the phishing mailbox.
  2. A SOC analyst investigates and decides if the email is safe or malicious.
    1. For safe emails, they inform the employee of the judgement.
    2. For malicious emails, they find the entire email campaign using tools such as Powershell.
  3. The SOC analyst removes the email campaign and alerts the employee of the malicious judgement.

All of these steps require manual intervention, as well as the use of ticketing or third-party tools to manage the mailbox workflow. However, most SOC analysts would prefer minimal involvement when it comes to monitoring their abuse mailbox. However, to get to a “set it and forget it” workflow requires automation and next-generation detection capabilities.

Automate Your Abuse Mailbox

With the Abuse Mailbox built-in to the Abnormal Security platform, we apply our AI-powered inbound protection technology to pass judgement on employee-reported phishing emails. In doing so, we automatically determine if an email—whether it’s a standalone message or a part of a coordinated campaign sent to multiple employees—is safe or malicious. Additionally, all malicious emails, including those a part of a campaign sitting in inboxes that are unreported, are auto-remediated from employee inboxes, giving analysts built-in mSOAR (email Security Orchestration, Automation and Response) capabilities.

Due to the effectiveness of Abnornal’s detection system, the result is a significant time savings for analysts, since they no longer need to spend time investigating safe phishing emails and can instead focus on real threats.

The Abnormal Security Abuse Mailbox can:

  • Pull all employee-reported emails in one place
  • Automatically provide email judgement via Abnormal’s signal detection capabilities
  • Collect the entire email attack campaign
  • Automatically remediate email campaigns that are deemed malicious
  • Automate employee notification support for safe and malicious reports
  • Integrate with existing ticketing systems such as ServiceNow, and SIEM/SOAR tools including Splunk, LogRhythm, QRadar, and Demisto, and
  • Integrate with Proofpoint TAP to show reports that have been ingested and processed by Abnormal

Abuse Mailbox is platform-independent and integrates with both Microsoft Office 365 and Google Workspace.

Experience an Improved Abuse Mailbox Today

With our improved mailbox UI, analysts can quickly view quantitative highlights of the submission breakdown between malicious, safe, and spam messages, as well as remediated campaigns and messages. The high-level summary above the campaign log allows analysts to receive a quick snapshot of Abuse Mailbox’s effectiveness. Additionally, if you’re a Proofpoint TAP customer, we have integrated into TAP to show reports that have been ingested and processed by Abnormal, giving analysts another look at how Abnormal would handle such events.

Multiple Remediation Options: Abuse Mailbox now supports a ‘Malicious (Permanently Delete)’ remediation option for analysts that want to remove entire campaigns from users’ inboxes for both Office 365 and Google Workspace.

Powerful Dashboard and Reporting Capabilities: We’ve added numerous dashboards and reporting options to improve visibility into key metrics and activity across the organization. Analysts can get a roll-up of reported phishing emails with a breakdown by judgement—malicious, safe, and spam. Additionally, Abnormal provides downloadable PDF and CSV reports with custom date ranges, especially useful for an executive audience.

You can also view remediation trends by attack types, and as well as the total number of emails, campaigns, and Proofpoint TAP-reported emails remediated by Abnormal over the selected time period.

In addition, we’ve made it easier to understand which employees in your organization report the most messages to Abuse Mailbox over a selected time period. Analysts can view the types of messages they’re reporting, as well as toggle between ‘All Reports’ or ‘Malicious Reports Only’.

Integrated Phishing Reporting Buttons: For organizations that have an existing end-user phishing report workflow, Abuse Mailbox integrates with Cofense/PhishMe and KnowBe4 buttons, as well as the native Microsoft O365 ‘Report Message’ button, giving employees the ability to report suspicious emails and notify security teams with just one click.

There's no longer a need to spend hours investigating user-report phishing attacks and remediating them. Let Abnormal do it for you.

Interested in seeing what Abnormal Security can do to improve your employee-reported mailbox? Request a demo to learn more.

Blog keyboard circle
Facebook phishing attacks are popular because users tend to use the same email address and password for other sites. In this attack, the cybercriminal impersonates Facebook to send out a phishing attack using a legitimate Facebook link.
Read More
Blog white building sky
Although tax season has passed, IRS impersonation scams persist, putting many Americans at risk for identity theft and payment fraud. In this attack, scammers impersonate the IRS by sending out a fake tax form to collect valuable personal and financial information.
Read More

Related Posts

Blog hiring cybersecurity leaders
As with every equation, there are always two sides and while it can be easy to blame users when they fall victim to scams and attacks, we also need to examine how we build and staff security teams.
Read More
Cover automated ato
With an increase in threat actor attention toward compromising accounts, Abnormal is focused on protecting our customers from this potentially high-profile threat. We are pleased to announce that our new Automated Account Takeover (ATO) Remediation functionality is available.
Read More
Email spoofing cover
Email spoofing is a common form of phishing attack designed to make the recipient believe that the message originates from a trusted source. A spoofed email is more than just a nuisance—it’s a malicious communication that poses a significant security threat.
Read More
Cover cybersecurity month kickoff
It’s time to turn the page on the calendar, and we are finally in October—the one month of the year when the spooky becomes reality. October is a unique juncture in the year as most companies are making the mad dash to year-end...
Read More
Ices announcement cover
Abnormal ICES offers all-in-one email security, delivering a precise approach to combat the full spectrum of email-borne threats. Powered by behavioral AI technology and deeply integrated with Microsoft 365...
Read More
Account takeover cover
Account takeovers are one of the biggest threats facing organizations of all sizes. They happen when cybercriminals gain legitimate login credentials and then use those credentials to send more attacks, acting like the person...
Read More
Blog podcast green cover
Many companies aspire to be customer-centric, but few find a way to operationalize customer-centricity into their team’s culture. As a 3x SaaS startup founder, most recently at Orum, and a veteran of Facebook and Palantir, Ayush Sood...
Read More
Blog attack atlassian cover
Credential phishing links are most commonly sent by email, and they typically lead to a website that is designed to look like common applications—most notably Microsoft Office 365, Google, Amazon, or other well-known...
Read More
Blog podcast purple cover
Working at hyper-growth startups usually means that unreasonable expectations will be thrust on individuals and teams. Demanding timelines, goals, and expectations can lead to high pressure, stress, accountability, and ultimately, extraordinary growth and achievements.
Read More
Blog yellow skyline
No one wants to receive an email from human resources that they aren’t expecting. After all, that usually means bad news. And when we think there may be bad news, cybersecurity training tends to fall by the wayside. Threat actors know this, and they’re taking advantage of human emotions.
Read More
Blog rising building
There is little doubt that business email compromise and other advanced email threats are causing significant damage–both financial and reputational—to organizations worldwide. Because these never-before-seen attacks contain few indicators of compromise, they evade secure email gateways and other traditional email infrastructure...
Read More
Blog purple person outline
Identity theft is not a joke, impacting more than 14 million people each year in the United States alone. Over the course of their lifetime, nearly one-third of all people will become victims of identity theft—often as a result of a corporate data breach. Once attackers have access to identifying information like your full name, address, date of birth, and/or social security number...
Read More