Exploring Deeper into Hidden Links
Many users tend to avoid clicking on the visible URLs in emails. Phishing attacks nowadays often employ redirect services like Microsoft SafeLinks, Google redirectors, or Proofpoint URLDefense to mask the actual destination of the link. Some even embed links within QR codes, hoping to bypass security measures.
Powered by Anubis.AI, MPS examines the true destination of URLs before users interact with them.
The system scrutinizes:
- Lookalike and typosquatted domains
- Newly registered or recently created hosts
- Suspicious redirect chains
- URLs hidden in QR codes
- Redirector-wrapped links from common security and marketing platforms
This provides security teams with insights into the final destination of a link, rather than just focusing on its outer appearance.
No More Safe Harbor for Encrypted Attachments
Attachments like password-protected PDFs and Office documents have posed challenges for email security solutions. Due to encryption, many gateways struggle to inspect them, leaving room for attackers to deliver malware, phishing content, or malicious documents undetected.
Utilizing Anubis.AI, MPS can scan emails for potential passwords and attempt to decrypt protected PDF files for analysis.
This feature enhances existing document analysis and prevents encrypted attachments from bypassing security measures simply because they are locked.
Powered by Anubis.AI
Driving these functionalities is Anubis.AI, the sophisticated analysis engine that fuels multiple defense modules within MPS.conducts thorough analysis of message content, attachments, images, and embedded elements, including:
- Extraction of native MIME with JSON-based manifests
- Extraction of URLs from various file formats
- Resolution of redirectors
- Decoding of QR codes from attachments and inline images
- Detection of password-protected files
- Precise file identification
- TNEF processing
- ICS calendar parsing and URL extraction
- Perceptual hashing of images (pHash)
In practical terms, this translates to reduced chances for attackers to camouflage malicious content through file format manipulation, embedded objects, or unconventional attachment types.
Assessing Document Risks
Not all documents pose equal threats. To assist security teams in prioritizing investigations, MPS employs Anubis.AI to assign a four-tier document risk rating:
- No suspicious elements detected
- Presence of risky active content
- Identification of high-risk active content
- Likelihood of exploitation is high
This rating system offers immediate context to analysts and aids in focusing attention on messages warranting action.
Reducing Attack Vectors
Cybercriminals continuously evolve their tactics to outsmart security defenses. As one method becomes detectable, another emerges to replace it.
By integrating pre-click URL assessment, encrypted attachment scrutiny, and in-depth content extraction, MPS helps thwart common evasion tactics employed in contemporary email attacks, including:
- Masked URLs
- QR-code phishing attempts
- Newly registered phishing domains
- Password-protected PDFs
- Misleading or disguised attachments
- Hidden content within complex file structures
This leads to enhanced visibility, heightened threat detection, and reduced chances for malicious payloads to slip past users undetected.
Experience the Solution in Action
MPS aids security teams in identifying threats before users engage with them, whether these threats are concealed behind redirect chains or locked within encrypted attachments.
MPS is now enhanced by Anubis.AI, expanding its capabilities in evaluating masked URLs, QR-code phishing schemes, and encrypted attachments before they escalate into security breaches. Request a demonstration of pre-click URL evaluation and encrypted attachment scanning utilizing a redirector-wrapped URL and a password-protected PDF.
