Panther rules: proofpoint

from panther_proofpoint_helpers import proofpoint_alert_context


def rule(event):
    # Check if any threats have a campaign ID
    for threat in event.get("threatsInfoMap", []):
        if threat.get("campaignID") and threat.get("threatStatus") == "active":
            return True

    return False


def severity(event):
    malware_score = event.get("malwareScore", 0)
    phish_score = event.get("phishScore", 0)

    if malware_score >= 90 or phish_score >= 90:
        return "CRITICAL"
    if malware_score >= 70 or phish_score >= 70:
        return "HIGH"
    return "DEFAULT"


def title(event):
    sender = event.get("sender", "<UNKNOWN_SENDER>")

    # Get campaign ID from first threat with one
    campaign_id = None
    for threat in event.get("threatsInfoMap", []):
        if threat.get("campaignID"):
            campaign_id = threat.get("campaignID")
            break

    if campaign_id:
        return f"Proofpoint: Active Threat Campaign Detected - {campaign_id}"
    return f"Proofpoint: Active Threat Campaign - Email from {sender}"


def alert_context(event):
    # Use the common helper
    context = proofpoint_alert_context(event)

    # Filter to only threats with campaign IDs
    all_threats = context["threats"]
    campaign_threats = [t for t in all_threats if "campaignID" in t]
    campaign_ids = set(t.get("campaignID") for t in campaign_threats if t.get("campaignID"))

    # Extend with campaign-specific fields
    context.update(
        {
            "campaignIDs": list(campaign_ids),
            "campaignCount": len(campaign_ids),
            "threats": campaign_threats,
        }
    )
    return context

AnalysisType: rule
Filename: proofpoint_threat_campaign.py
RuleID: "Proofpoint.ThreatCampaign"
DisplayName: "Proofpoint Active Threat Campaign Detected"
Enabled: true
LogTypes:
  - Proofpoint.Event
Status: Experimental
Tags:
  - Proofpoint
  - Email Security
  - Phishing
  - Malware
  - Campaign
  - Initial Access:Phishing
  - Execution:User Execution
  - Resource Development:Develop Capabilities
Severity: High
Description: >
  This rule alerts when Proofpoint identifies an email as part of an active
  threat campaign. Campaign-based threats indicate coordinated attacks that
  are targeting multiple organizations or users. These threats are typically
  more sophisticated and require immediate attention.
Runbook: |
  1. Search for all emails from this campaign in the last 30 days and verify quarantine status across the organization
  2. Block all campaign IOCs (domains, IPs, file hashes) within 15 minutes and check Proofpoint Threat Insight for details
  3. Initiate threat hunting within 2 hours for lateral movement and share IOCs with threat intelligence platforms
Reference: https://help.proofpoint.com/Threat_Insight_Dashboard/API_Documentation/Campaign_API
Reports:
  MITRE ATT&CK:
    - TA0042:T1587 # Resource Development: Develop Capabilities
    - TA0001:T1566 # Initial Access: Phishing
    - TA0002:T1204 # Execution: User Execution

from panther_proofpoint_helpers import proofpoint_alert_context


def rule(event):
    # Alert on impostor scores of 50 or higher
    return event.get("impostorScore", 0) >= 50


def severity(event):
    impostor_score = event.get("impostorScore", 0)

    if impostor_score >= 80:
        return "CRITICAL"
    if impostor_score >= 65:
        return "HIGH"
    if impostor_score >= 50:
        return "MEDIUM"
    return "DEFAULT"


def title(event):
    sender = event.get("sender", "<UNKNOWN_SENDER>")
    impostor_score = event.get("impostorScore", 0)
    return f"Proofpoint: High Impostor Score ({impostor_score}) " f"- Email from {sender}"


def alert_context(event):
    # Use the common helper and extend with impostor-specific fields
    context = proofpoint_alert_context(event)
    context.update(
        {
            "spamScore": event.get("spamScore", 0),
            "impostorScore": event.get("impostorScore", 0),
            "headerFrom": event.get("headerFrom", "<UNKNOWN_HEADER_FROM>"),
        }
    )
    return context

AnalysisType: rule
Filename: proofpoint_high_impostor_score.py
RuleID: "Proofpoint.HighImpostorScore"
DisplayName: "Proofpoint High Impostor Score Detected"
Enabled: true
LogTypes:
  - Proofpoint.Event
Status: Experimental
Tags:
  - Proofpoint
  - Email Security
  - Business Email Compromise
  - BEC
  - Impersonation
  - Phishing
  - Initial Access:Phishing
Severity: Medium
Description: >
  This rule alerts when Proofpoint detects a high impostor score (50+),
  indicating potential Business Email Compromise (BEC) or impersonation
  attacks. The impostor score measures the likelihood that the sender is
  impersonating a trusted entity. Severity is dynamic based on the score:
  CRITICAL (80+), HIGH (65+), MEDIUM (50+).
Runbook: |
  1. Review sender details for lookalike domains and verify if recipients took action on the email within the last 24 hours
  2. If BEC is confirmed, immediately notify finance/accounting teams and block the sender domain
  3. Report to law enforcement within 24 hours if financial fraud was attempted or executives were impersonated
Reference: https://www.proofpoint.com/us/threat-reference/business-email-compromise
Reports:
  MITRE ATT&CK:
    - TA0001:T1566 # Initial Access: Phishing

from panther_proofpoint_helpers import proofpoint_alert_context


def rule(event):
    # Exclude events already handled by the Virus Detected rule
    if event.get("quarantineFolder") == "Virus" or event.get("quarantineRule") == "notcleaned":
        return False
    return event.get("quarantineRule") == "malware" or event.get("malwareScore", 0) >= 90


def severity(event):
    malware_score = event.get("malwareScore", 0)

    if malware_score >= 95:
        return "CRITICAL"
    if malware_score >= 90:
        return "HIGH"
    return "DEFAULT"


def title(event):
    subject = event.get("subject", "<UNKNOWN_SUBJECT>")
    sender = event.get("sender", "<UNKNOWN_SENDER>")
    return f"Proofpoint: Malware Detected in Email from {sender} " f"- [{subject}]"


def dedup(event):
    # Deduplicate by sender and threat type to group related malware alerts
    sender = event.get("sender", "<UNKNOWN_SENDER>")
    quarantine_rule = event.get("quarantineRule", "malware")
    return f"proofpoint:malware:{sender}:{quarantine_rule}"


def alert_context(event):
    # Use the common helper and extend with malware-specific fields
    context = proofpoint_alert_context(event)
    context["messageSize"] = event.get("messageSize", 0)
    return context

AnalysisType: rule
Filename: proofpoint_malware_detected.py
RuleID: "Proofpoint.MalwareDetected"
DisplayName: "Proofpoint Malware Detected"
Enabled: true
LogTypes:
  - Proofpoint.Event
Status: Experimental
Tags:
  - Proofpoint
  - Email Security
  - Malware
  - Phishing
  - Initial Access:Phishing
  - Execution:User Execution
Severity: High
Description: >
  This rule alerts when Proofpoint detects malware in an email message.
  It triggers when emails are quarantined with the malware rule or when
  the malware score is 90 or higher. Events quarantined to the Virus folder
  or with the notcleaned rule are handled by the Virus Detected rule instead.
Runbook: |
  1. Verify the email was quarantined and check if recipients interacted with malicious content within the last 2 hours
  2. Block the sender domain/IP within 15 minutes and notify affected users immediately
  3. Escalate to IR team within 30 minutes if malware execution is confirmed on endpoints
Reference: https://www.proofpoint.com/sites/default/files/pfpt-us-ebook-stopping-malware-with-proofpoint-advanced-email-protection.pdf
Reports:
  MITRE ATT&CK:
    - TA0001:T1566 # Initial Access: Phishing
    - TA0002:T1204 # Execution: User Execution

from panther_proofpoint_helpers import proofpoint_alert_context


def get_active_threat_count(event):
    # Count the number of active threats in the event using list comprehension
    return len([t for t in event.get("threatsInfoMap", []) if t.get("threatStatus") == "active"])


def rule(event):
    # Must have at least 3 active threats to reduce overlap with single-vector rules
    return get_active_threat_count(event) >= 3


def severity(event):
    active_count = get_active_threat_count(event)

    if active_count >= 5:
        return "CRITICAL"
    if active_count >= 3:
        return "HIGH"
    return "DEFAULT"


def dedup(event):
    sender = event.get("sender", "<UNKNOWN_SENDER>")
    return f"proofpoint:multiple_threats:{sender}"


def title(event):
    sender = event.get("sender", "<UNKNOWN_SENDER>")
    active_count = get_active_threat_count(event)
    return f"Proofpoint: Multiple Threats Detected ({active_count}) - Email from {sender}"


def alert_context(event):
    # Use the common helper
    context = proofpoint_alert_context(event)

    # Filter to only active threats
    all_threats = context["threats"]
    active_threats = [t for t in all_threats if t.get("threatStatus") == "active"]
    threat_types = set(t.get("threatType") for t in active_threats if t.get("threatType"))
    classifications = set(
        t.get("classification") for t in active_threats if t.get("classification")
    )

    # Extend with multiple threat-specific fields
    context.update(
        {
            "threatCount": len(active_threats),
            "threatTypes": list(threat_types),
            "classifications": list(classifications),
            "threats": active_threats,
        }
    )
    return context

AnalysisType: rule
Filename: proofpoint_multiple_threats.py
RuleID: "Proofpoint.MultipleThreats"
DisplayName: "Proofpoint Multiple Threats Detected"
Enabled: true
LogTypes:
  - Proofpoint.Event
Status: Experimental
Tags:
  - Proofpoint
  - Email Security
  - Phishing
  - Malware
  - Initial Access:Phishing
  - Execution:User Execution
Severity: High
Description: >
  This rule alerts when three or more active threats are detected in a single
  email message. This indicates a sophisticated multi-vector attack combining
  malware, phishing URLs, and malicious attachments. Severity is dynamic:
  CRITICAL (5+ threats), HIGH (3-4 threats).
Runbook: |
  1. Verify the email was quarantined and review all threat types in the alert context immediately
  2. Block sender infrastructure within 15 minutes and search for similar multi-vector attacks from the last 7 days
  3. Escalate to threat intelligence team within 1 hour for campaign analysis and update security controls
Reference: https://www.proofpoint.com/us/resources/webinars/blocking-multi-vector-attacks
Reports:
  MITRE ATT&CK:
    - TA0001:T1566 # Initial Access: Phishing
    - TA0002:T1204 # Execution: User Execution

from panther_proofpoint_helpers import proofpoint_alert_context


def rule(event):
    # Check if quarantined for phish
    if event.get("quarantineRule") == "phish" or event.get("quarantineFolder") == "Phish":
        return True

    # Check for high phish score
    if event.get("phishScore", 0) >= 90:
        return True

    # Check threats map for phishing classification
    for threat in event.get("threatsInfoMap", []):
        if threat.get("classification") == "phish" and threat.get("threatStatus") == "active":
            return True

    return False


def severity(event):
    phish_score = event.get("phishScore", 0)

    if phish_score >= 95:
        return "CRITICAL"
    if phish_score >= 90:
        return "HIGH"
    return "DEFAULT"


def title(event):
    subject = event.get("subject", "<UNKNOWN_SUBJECT>")
    sender = event.get("sender", "<UNKNOWN_SENDER>")
    return f"Proofpoint: Phishing Email Detected from {sender} - [{subject}]"


def dedup(event):
    # Deduplicate by sender and threat type to group related phishing alerts
    sender = event.get("sender", "<UNKNOWN_SENDER>")
    quarantine_folder = event.get("quarantineFolder", "phish")
    return f"proofpoint:phishing:{sender}:{quarantine_folder}"


def alert_context(event):
    # Use the common helper with threat URLs for phishing detection
    context = proofpoint_alert_context(event, include_threat_url=True)
    context["headerFrom"] = event.get("headerFrom", "<UNKNOWN_HEADER_FROM>")
    return context

AnalysisType: rule
Filename: proofpoint_phishing_detected.py
RuleID: "Proofpoint.PhishingDetected"
DisplayName: "Proofpoint Phishing Email Detected"
Enabled: true
LogTypes:
  - Proofpoint.Event
Status: Experimental
Tags:
  - Proofpoint
  - Email Security
  - Phishing
  - Credential Theft
  - Initial Access:Phishing
  - Credential Access:Phishing for Information
Severity: High
Description: >
  This rule alerts when Proofpoint detects phishing attempts in email.
  It triggers when emails are quarantined with the phish rule, have a
  high phish score (90+), or contain active phishing threats in the
  threats map.
Runbook: |
  1. Check if users clicked on malicious links within the last 4 hours and force password reset immediately if credentials may be compromised
  2. Block the sender domain/URL within 15 minutes and notify affected users
  3. Report to anti-phishing authorities within 24 hours and share IOCs with threat intelligence platforms
Reference: https://www.proofpoint.com/us/solutions/protect-against-phishing
Reports:
  MITRE ATT&CK:
    - TA0001:T1566 # Initial Access: Phishing
    - TA0006:T1598 # Credential Access: Phishing for Information

from panther_proofpoint_helpers import proofpoint_alert_context


def rule(event):
    quarantine_rule = event.get("quarantineRule", "")
    quarantine_folder = event.get("quarantineFolder", "")

    # Alert only on virus-specific quarantine indicators
    return quarantine_rule == "notcleaned" or quarantine_folder == "Virus"


def severity(event):
    malware_score = event.get("malwareScore", 0)

    if malware_score >= 95:
        return "CRITICAL"
    if malware_score >= 85:
        return "HIGH"
    return "DEFAULT"


def title(event):
    subject = event.get("subject", "<UNKNOWN_SUBJECT>")
    sender = event.get("sender", "<UNKNOWN_SENDER>")
    return f"Proofpoint: Virus Detected in Email from {sender} " f"- [{subject}]"


def dedup(event):
    # Deduplicate by sender and threat type to group related virus alerts
    sender = event.get("sender", "<UNKNOWN_SENDER>")
    quarantine_folder = event.get("quarantineFolder", "Virus")
    return f"proofpoint:virus:{sender}:{quarantine_folder}"


def alert_context(event):
    # Use the common helper and extend with virus-specific fields
    context = proofpoint_alert_context(event)
    context["messageSize"] = event.get("messageSize", 0)
    return context

AnalysisType: rule
Filename: proofpoint_virus_detected.py
RuleID: "Proofpoint.VirusDetected"
DisplayName: "Proofpoint Virus Detected"
Enabled: true
LogTypes:
  - Proofpoint.Event
Status: Experimental
Tags:
  - Proofpoint
  - Email Security
  - Virus
  - Malware
  - Phishing
  - Initial Access:Phishing
  - Execution:User Execution
Severity: High
Description: >
  This rule alerts when Proofpoint detects a virus in an email that cannot
  be disinfected. It triggers when emails are quarantined to the Virus folder
  or have the notcleaned quarantine rule applied.
Runbook: |
  1. Confirm the email was quarantined and immediately verify endpoint protection status on recipient systems
  2. Block the sender domain/IP within 15 minutes and search for similar emails from the last 7 days
  3. Escalate to IR team within 30 minutes if virus delivery to endpoints is confirmed
Reference: https://www.proofpoint.com/sites/default/files/2020-05/pfpt-uk-ds-email-protection.pdf
Reports:
  MITRE ATT&CK:
    - TA0001:T1566 # Initial Access: Phishing
    - TA0002:T1204 # Execution: User Execution