Let's take a look at how Abnormal is able to detect link-based malware attacks.
In this example, we see an email that appears to be coming from DocuSign Service. However, this email is coming from a user account@horizonmanagement[.]com—very likely a compromised account that a threat actor is leveraging in an attempt to bypass sender authentication checks from traditional secure email gateways.
Within the body of the email, we do see an invoice and a link that goes out to it, and I can click this to get a quick preview. In this case, the threat actor is using Google Docs to bypass any sort of threat intelligence or sandboxing checks that would take place on this.
And within the actual body of this Google document, we see an invoice that's able to be clicked as well as DocuSign logos. Of course, this was just generated by the threat actor. This is not a real DocuSign service, and this link could do a multitude of different things when the user clicked on it. It could take them out to a credential phishing website, or in this case, it would actually initiate a drive-by download of a file that would automatically run.
How is Abnormal able to uniquely detect this attack?
First of all, we see an unusual sender. This sender name matches a known brand of DocuSign, but we don't typically see emails from DocuSign coming from this email address. Within the body of the email, we're seeing file sharing links, which are commonly associated with these malicious payloads. We do see some personal information theft or language around it. And lastly, we see this suspicious financial request. Again, with the language of this email, looking at the text analysis, we see some language around finances and password-related information here.
So Abnormal was able to accurately detect this email as malware. Based on all this attack analysis that we did here, this would've been automatically remediated and never accessible to the end user.
