/threats

name: "Abnormal Security Threats"
description: >
  Abnormal Security threat detection: threat types (BEC, phishing, malware,
  socially-engineered attacks, spam, graymail, credential theft), attack
  vectors, severity assessment, remediation actions, and investigation
  workflows.
when_to_use: >-
  When investigating an email-borne threat detected by Abnormal Security's
  behavioral engine. Use when: abnormal threat, abnormal security threat,
  email threat, bec detection, business email compromise, phishing
  detection, credential phishing, malware email, socially engineered attack,
  threat analysis abnormal, email attack, threat severity, or abnormal
  threat investigation.

Abnormal Security Threat Detection & Analysis

Overview

Abnormal Security uses behavioral AI to detect email threats that bypass traditional secure email gateways (SEGs). Unlike signature or rule-based detection, Abnormal profiles normal communication patterns and detects deviations indicative of attacks. This skill covers threat types, attack vectors, severity assessment, remediation, and investigation workflows.

Anti-triggers

• **An email a user reported to the abuse mailbox** — those arrive as

cases carrying their own AI judgment and action set; use `Abnormal Security Cases`.

• **A mailbox behaving strangely rather than an email arriving** —

impossible travel, new inbox rules, and lateral sending are account compromise, and this server exposes no account-takeover surface at all. Investigate identity in the M365 tenant instead; use `cipp-users`.

• **Header, SPF/DKIM/DMARC, or attachment forensics on one message** —

use `Abnormal Security Messages`.

• **Releasing something from a quarantine queue** — Abnormal has no

gateway queue. It inspects mail post-delivery through the M365 API and pulls it back out of inboxes. Anything sitting in a hold queue belongs to the gateway holding it: `SpamTitan Quarantine`, `Mimecast Message Tracking`, or `Proofpoint Quarantine`.

• **A threat the gateway already stopped** — mail blocked before

delivery never reaches the mailbox, so Abnormal never sees it. Search the gateway's own logs.

• **The same mail flagged by Check Point Harmony Email** — Avanan is

the other API-based, post-delivery platform on this stack and produces its own threat records; use `avanan-threats`.

Threat Types

| Type | Description | Severity Range | |------|-------------|----------------| | **BEC (Business Email Compromise)** | Impersonation of executives or trusted contacts to request financial actions | High - Critical | | **Credential Phishing** | Emails designed to harvest credentials via fake login pages | Medium - Critical | | **Malware** | Emails containing malicious attachments or links to malware downloads | High - Critical | | **Extortion** | Threatening emails demanding payment (sextortion, DDoS threats) | Medium - High | | **Social Engineering** | Manipulation attacks using urgency, authority, or trust | Medium - Critical | | **Spam** | Unsolicited bulk email | Low | | **Graymail** | Marketing, newsletters, and promotional content | Low | | **Scam** | Advance-fee fraud, fake invoices, lottery scams | Medium - High | | **Supply Chain Compromise** | Attacks from compromised vendor or partner email accounts | Critical |

Detection Approach

| Engine | Description | What It Detects | |--------|-------------|-----------------| | **Behavioral AI** | Models normal communication patterns per user/org | BEC, social engineering, impersonation | | **Content Analysis** | NLP analysis of email body and intent | Urgency, financial requests, credential harvesting | | **Sender Profiling** | Reputation and authentication of sender | Spoofing, domain impersonation, first-time senders | | **URL Analysis** | Real-time scanning of embedded links | Credential phishing pages, malware delivery | | **Attachment Analysis** | File inspection and sandboxing | Malware, ransomware payloads | | **VendorBase** | Vendor risk intelligence network | Supply chain compromise, compromised vendor accounts |

Threat Field Reference

Core Fields

| Field | Type | Description | |-------|------|-------------| | `threatId` | string | Unique threat identifier (UUID) | | `abxMessageId` | long | Abnormal internal message ID | | `abxPortalUrl` | string | Direct link to threat in Abnormal portal | | `attackType` | string | BEC, PHISHING, MALWARE, EXTORTION, SPAM, etc. | | `attackStrategy` | string | Specific attack strategy (e.g., "Invoice/Payment Fraud") | | `sentTime` | datetime | When the email was sent | | `receivedTime` | datetime | When the email was received | | `attackVector` | string | How the attack was delivered (Link, Attachment, Text) | | `summaryInsights` | string[] | AI-generated summary of why this is a threat |

Sender Fields

| Field | Type | Description | |-------|------|-------------| | `senderAddress` | string | Sender email address | | `senderName` | string | Sender display name | | `fromAddress` | string | From header address | | `fromName` | string | From header display name | | `replyToEmails` | string[] | Reply-to addresses | | `returnPath` | string | Return-path/envelope sender | | `senderIpAddress` | string | Originating IP address | | `senderDomain` | string | Sender domain | | `impersonatedParty` | string | Who is being impersonated (if applicable) |

Recipient Fields

| Field | Type | Description | |-------|------|-------------| | `recipientAddress` | string | Primary recipient | | `toAddresses` | string[] | All To: addresses | | `ccAddresses` | string[] | All CC: addresses |

Remediation Fields

| Field | Type | Description | |-------|------|-------------| | `remediationStatus` | string | Auto-Remediated, Not Remediated, Post-Remediated | | `remediationTimestamp` | datetime | When remediation action was taken | | `postRemediated` | boolean | Whether email was remediated after delivery | | `isRead` | boolean | Whether the recipient read the em