Detection rules › Panther
Proofpoint Multiple Threats Detected
This rule alerts when three or more active threats are detected in a single email message. This indicates a sophisticated multi-vector attack combining malware, phishing URLs, and malicious attachments. Severity is dynamic: CRITICAL (5+ threats), HIGH (3-4 threats).
MITRE ATT&CK coverage
| Tactic | Techniques |
|---|---|
| Initial Access | T1566 Phishing |
| Execution | T1204 User Execution |
Rule body yaml
AnalysisType: rule
Filename: proofpoint_multiple_threats.py
RuleID: "Proofpoint.MultipleThreats"
DisplayName: "Proofpoint Multiple Threats Detected"
Enabled: true
LogTypes:
- Proofpoint.Event
Status: Experimental
Tags:
- Proofpoint
- Email Security
- Phishing
- Malware
- Initial Access:Phishing
- Execution:User Execution
Severity: High
Description: >
This rule alerts when three or more active threats are detected in a single
email message. This indicates a sophisticated multi-vector attack combining
malware, phishing URLs, and malicious attachments. Severity is dynamic:
CRITICAL (5+ threats), HIGH (3-4 threats).
Runbook: |
1. Verify the email was quarantined and review all threat types in the alert context immediately
2. Block sender infrastructure within 15 minutes and search for similar multi-vector attacks from the last 7 days
3. Escalate to threat intelligence team within 1 hour for campaign analysis and update security controls
Reference: https://www.proofpoint.com/us/resources/webinars/blocking-multi-vector-attacks
Reports:
MITRE ATT&CK:
- TA0001:T1566 # Initial Access: Phishing
- TA0002:T1204 # Execution: User Execution
Tests:
- Name: Two Active Threats - No Alert
ExpectedResult: false
Log:
messageTime: "2026-01-08T12:00:00Z"
sender: "attacker@evil.com"
senderIP: "192.0.2.88"
fromAddress:
- "attacker@evil.com"
toAddresses:
- "victim@company.com"
recipient:
- "victim@company.com"
subject: "Urgent Action Required"
malwareScore: 80
phishScore: 75
spamScore: 20
impostorScore: 10
quarantineFolder: "Attachment Defense"
quarantineRule: "threat"
messageID: "<multi-threat@evil.com>"
threatsInfoMap:
- threatType: "attachment"
classification: "malware"
threatStatus: "active"
threat: "invoice.exe"
threatID: "threat-001"
- threatType: "url"
classification: "phish"
threatStatus: "active"
threat: "http://fake-login.com/verify"
threatID: "threat-002"
- Name: Five Active Threats - Critical
ExpectedResult: true
Log:
messageTime: "2026-01-08T13:30:00Z"
sender: "sophisticated@attacker.net"
senderIP: "198.51.100.123"
fromAddress:
- "sophisticated@attacker.net"
toAddresses:
- "target@company.com"
recipient:
- "target@company.com"
subject: "Critical Update Required"
malwareScore: 95
phishScore: 90
spamScore: 50
impostorScore: 20
quarantineFolder: "Attachment Defense"
quarantineRule: "threat"
messageID: "<advanced-threat@attacker.net>"
threatsInfoMap:
- threatType: "attachment"
classification: "malware"
threatStatus: "active"
threat: "update.zip"
threatID: "threat-003"
- threatType: "url"
classification: "phish"
threatStatus: "active"
threat: "http://phish1.com"
threatID: "threat-004"
- threatType: "url"
classification: "phish"
threatStatus: "active"
threat: "http://phish2.com"
threatID: "threat-005"
- threatType: "attachment"
classification: "malware"
threatStatus: "active"
threat: "document.pdf"
threatID: "threat-006"
- threatType: "url"
classification: "malware"
threatStatus: "active"
threat: "http://malware-download.com"
threatID: "threat-007"
- Name: Three Active Threats - High Severity
ExpectedResult: true
Log:
messageTime: "2026-01-08T14:00:00Z"
sender: "bad-actor@malicious.org"
senderIP: "203.0.113.77"
fromAddress:
- "bad-actor@malicious.org"
toAddresses:
- "employee@company.com"
recipient:
- "employee@company.com"
subject: "Invoice Attached"
malwareScore: 70
phishScore: 65
spamScore: 15
impostorScore: 5
quarantineFolder: "Attachment Defense"
quarantineRule: "threat"
messageID: "<triple-threat@malicious.org>"
threatsInfoMap:
- threatType: "attachment"
classification: "malware"
threatStatus: "active"
threat: "invoice.doc"
threatID: "threat-008"
- threatType: "url"
classification: "phish"
threatStatus: "active"
threat: "http://credential-stealer.com"
threatID: "threat-009"
- threatType: "url"
classification: "malware"
threatStatus: "active"
threat: "http://drive-by-download.net"
threatID: "threat-010"
- Name: One Active Threat - No Alert
ExpectedResult: false
Log:
messageTime: "2026-01-08T15:00:00Z"
sender: "sender@example.com"
senderIP: "198.51.100.50"
fromAddress:
- "sender@example.com"
toAddresses:
- "user@company.com"
recipient:
- "user@company.com"
subject: "Suspicious Link"
malwareScore: 5
phishScore: 60
spamScore: 10
impostorScore: 0
quarantineFolder: "Phish"
quarantineRule: "phish"
messageID: "<single-threat@example.com>"
threatsInfoMap:
- threatType: "url"
classification: "phish"
threatStatus: "active"
threat: "http://phishing-site.com"
threatID: "threat-011"
- Name: One Active With Multiple Cleared - No Alert
ExpectedResult: false
Log:
messageTime: "2026-01-08T15:30:00Z"
sender: "mixed-status@example.com"
senderIP: "203.0.113.88"
fromAddress:
- "mixed-status@example.com"
toAddresses:
- "user@company.com"
recipient:
- "user@company.com"
subject: "Mixed Threat Status"
malwareScore: 30
phishScore: 40
spamScore: 15
impostorScore: 0
quarantineFolder: "Phish"
quarantineRule: "phish"
messageID: "<mixed-threats@example.com>"
threatsInfoMap:
- threatType: "url"
classification: "phish"
threatStatus: "active"
threat: "http://active-phish.com"
threatID: "threat-014"
- threatType: "attachment"
classification: "malware"
threatStatus: "cleared"
threat: "old-malware.exe"
threatID: "threat-015"
- threatType: "url"
classification: "malware"
threatStatus: "cleared"
threat: "http://cleared-malware.com"
threatID: "threat-016"
- Name: Multiple Threats But Not Active - No Alert
ExpectedResult: false
Log:
messageTime: "2026-01-08T16:00:00Z"
sender: "old-threat@example.com"
senderIP: "203.0.113.99"
fromAddress:
- "old-threat@example.com"
toAddresses:
- "user@company.com"
recipient:
- "user@company.com"
subject: "Old Campaign"
malwareScore: 10
phishScore: 10
spamScore: 5
impostorScore: 0
messageID: "<inactive-threats@example.com>"
threatsInfoMap:
- threatType: "url"
classification: "phish"
threatStatus: "cleared"
threat: "http://old-phish.com"
threatID: "threat-012"
- threatType: "attachment"
classification: "malware"
threatStatus: "cleared"
threat: "old-malware.exe"
threatID: "threat-013"
Detection logic
Rule logic imperative Python
from panther_proofpoint_helpers import proofpoint_alert_context
def get_active_threat_count(event):
return len([t for t in event.get("threatsInfoMap", []) if t.get("threatStatus") == "active"])
def rule(event):
return get_active_threat_count(event) >= 3
def severity(event):
active_count = get_active_threat_count(event)
if active_count >= 5:
return "CRITICAL"
if active_count >= 3:
return "HIGH"
return "DEFAULT"
def dedup(event):
sender = event.get("sender", "<UNKNOWN_SENDER>")
return f"proofpoint:multiple_threats:{sender}"
def title(event):
sender = event.get("sender", "<UNKNOWN_SENDER>")
active_count = get_active_threat_count(event)
return f"Proofpoint: Multiple Threats Detected ({active_count}) - Email from {sender}"
def alert_context(event):
context = proofpoint_alert_context(event)
all_threats = context["threats"]
active_threats = [t for t in all_threats if t.get("threatStatus") == "active"]
threat_types = set(t.get("threatType") for t in active_threats if t.get("threatType"))
classifications = set(
t.get("classification") for t in active_threats if t.get("classification")
)
context.update(
{
"threatCount": len(active_threats),
"threatTypes": list(threat_types),
"classifications": list(classifications),
"threats": active_threats,
}
)
return context
The parser cannot express this rule's logic as a field filter; the imperative Python above is the detection.
Output fields
Fields the rule emits when it matches. Chronicle authors list these in the outcome block; they appear on the detection and $risk_score drives alerting. Sentinel / Defender XDR rules build them up through project / summarize / extend stages. Sentinel maps these into alert fields via entityMappings and customDetails; Defender XDR custom detections surface them as alert fields directly.
| Field | Source |
|---|---|
sender | |
senderIP | |
recipients | recipient |
subject | |
messageID | |
quarantineFolder | |
quarantineRule | |
malwareScore | |
phishScore |