What it does. Email sandboxing detonates suspicious attachments and URLs in isolated Part of mukul975/Anthropic-Cybersecurity-Skills (817 security skills) (mukul975/Anthropic-Cybersecurity-Skills).

Install

• npx skills add mukul975/Anthropic-Cybersecurity-Skills --skill implementing-email-sandboxing-with-proofpoint, or copy the skill folder into ~/.claude/skills/implementing-email-sandboxing-with-proofpoint/.
• Raw file: curl -sL https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/implementing-email-sandboxing-with-proofpoint/SKILL.md

SKILL.md (verbatim)

name: implementing-email-sandboxing-with-proofpoint
description: Email sandboxing detonates suspicious attachments and URLs in isolated
  environments to detect zero-day malware and evasive phishing payloads. Proofpoint
  Targeted Attack Protection (TAP) is an industry
domain: cybersecurity
subdomain: phishing-defense
tags:
- phishing
- email-security
- social-engineering
- dmarc
- awareness
- sandboxing
- proofpoint
version: '1.0'
author: mahipal
license: Apache-2.0
nist_csf:
- PR.AT-01
- DE.CM-09
- RS.CO-02
- DE.AE-02
mitre_attack:
- T1566
- T1598
- T1534
- T1036
- T1027

Implementing Email Sandboxing with Proofpoint

Overview

Email sandboxing detonates suspicious attachments and URLs in isolated environments to detect zero-day malware and evasive phishing payloads. Proofpoint Targeted Attack Protection (TAP) is an industry-leading solution that uses multi-stage sandboxing, URL rewriting, and predictive analysis. This skill covers configuring Proofpoint TAP, integrating with email flow, analyzing sandbox reports, and tuning detection policies.

When to Use

• When deploying or configuring implementing email sandboxing with proofpoint capabilities in your environment
• When establishing security controls aligned to compliance requirements
• When building or improving security architecture for this domain
• When conducting security assessments that require this implementation

Prerequisites

• Proofpoint Email Protection license with TAP add-on
• Admin access to Proofpoint admin console
• Understanding of email delivery architecture (MX records, mail flow rules)
• SIEM integration capability

Key Concepts

Proofpoint TAP Capabilities

1. Attachment sandboxing: Detonates files in virtual machines (Windows, macOS, Android)
2. URL Defense: Rewrites URLs, detonates at time-of-click
3. Threat Intelligence: Proofpoint's NexusAI threat intelligence integration
4. TAP Dashboard: Real-time visibility into threats targeting the organization
5. Campaign correlation: Groups related attacks into campaigns
6. Very Attacked People (VAP): Identifies most-targeted individuals

Sandbox Evasion Techniques Detected

• Delayed execution (time-bomb malware)
• VM detection bypass
• User interaction requirements (click-to-enable macros)
• Sandbox-aware malware that checks for analysis environment
• Encrypted/password-protected attachments
• Multi-stage payloads with delayed C2 retrieval

Workflow

Step 1: Configure TAP in Proofpoint

• Enable TAP for inbound email policy
• Configure sandbox profiles (attachment types to detonate)
• Set URL Defense rewriting policy
• Configure quarantine actions for malicious verdicts

Step 2: Tune Attachment Policies

Recommended attachment policy:
- Detonate: .exe, .dll, .scr, .doc(m), .xls(m), .ppt(m), .pdf, .zip, .rar, .7z, .iso
- Block without detonation: .bat, .cmd, .ps1, .vbs, .js, .wsf, .hta
- Password-protected archives: Attempt common passwords, then quarantine
- Dynamic delivery: Deliver email body, hold attachment until verdict

Step 3: Configure URL Defense

• Enable URL rewriting for all inbound email
• Set time-of-click detonation
• Block access to malicious URLs
• Show warning page for suspicious (not confirmed malicious) URLs
• Configure allowed domains bypass list

Step 4: Set Up TAP Dashboard Monitoring

• Configure daily threat digest emails to security team
• Set up real-time alerts for targeted attacks
• Monitor VAP report for high-risk users
• Review campaign clusters for coordinated attacks

Step 5: Integrate with SIEM

• Configure syslog/API export to SIEM
• Create correlation rules for TAP alerts
• Set up automated response workflows

Tools & Resources

• Proofpoint TAP: https://www.proofpoint.com/us/products/advanced-threat-protection
• Proofpoint TAP Dashboard: https://threatinsight.proofpoint.com/
• Proofpoint API: https://help.proofpoint.com/Threat_Insight_Dashboard/API_Documentation
• Proofpoint Community: https://community.proofpoint.com/

Validation

• Attachment detonation catches EICAR test file and macro-enabled document
• URL Defense rewrites and blocks known phishing URLs
• TAP Dashboard displays threat summary
• SIEM receives and alerts on TAP events

Other files in this skill

• LICENSE
• assets/template.md
• references/api-reference.md
• references/standards.md
• references/workflows.md
• scripts/agent.py
• scripts/process.py

assets/template.md (verbatim)

Email Sandboxing Configuration Template (Proofpoint TAP)

Deployment Info

• Product: Proofpoint Email Protection + TAP
• Deployment Date: [YYYY-MM-DD]
• MX Records Updated: Yes/No
• SIEM Integration: [Splunk / Sentinel / QRadar]

Attachment Sandbox Policy

URL Defense Policy

Monitoring Checklist

• Daily: Review TAP Dashboard threat digest
• Daily: Check quarantine for false positives
• Weekly: Review VAP list
• Weekly: Analyze threat trends
• Monthly: Generate executive threat report
• Quarterly: Policy tuning review

references/api-reference.md (verbatim)

API Reference: Implementing Email Sandboxing with Proofpoint

Proofpoint TAP SIEM API

import requests
resp = requests.get(
    "https://tap-api-v2.proofpoint.com/v2/siem/all",
    auth=(principal, secret),
    params={"sinceSeconds": 3600, "format": "json"})
data = resp.json()
# Keys: messagesDelivered, messagesBlocked, clicksPermitted, clicksBlocked

TAP API Endpoints

Threat Categories

URL Defense Configuration

{
  "url_defense": {
    "rewrite_all_urls": true,
    "real_time_scanning": true,
    "sandbox_detonation": true,
    "click_time_protection": true
  }
}

Splunk Integration

index=proofpoint sourcetype=tap:siem
| where classification="malicious"
| stats count by sender, threatType, subject

References

• Proofpoint TAP API: https://help.proofpoint.com/Threat_Insight_Dashboard/API_Documentation
• Proofpoint Email Protection: https://www.proofpoint.com/us/products/email-security-and-protection

references/standards.md (verbatim)

Standards & References: Email Sandboxing with Proofpoint

MITRE ATT&CK Coverage

• T1566.001: Phishing: Spearphishing Attachment (primary detection)
• T1566.002: Phishing: Spearphishing Link (URL Defense)
• T1204.001/002: User Execution: Malicious Link/File
• T1059: Command and Scripting Interpreter (macro detection)
• T1027: Obfuscated Files or Information

NIST Guidelines

• NIST SP 800-177: Trustworthy Email - attachment security
• NIST SP 800-83 Rev.1: Guide to Malware Incident Prevention
• NIST SP 800-53: SI-3 Malicious Code Protection, SI-8 Spam Protection

Proofpoint TAP API Endpoints

Sandbox File Types

references/workflows.md (verbatim)

Workflows: Email Sandboxing with Proofpoint

Workflow 1: Attachment Detonation Pipeline

Email with attachment arrives at Proofpoint gateway
  |
  v
[Pre-filter: Check attachment type]
  +-- Blocked types (.bat, .ps1, .vbs) --> Quarantine immediately
  +-- Detonable types --> Send to sandbox
  +-- Known safe types (.txt, .csv) --> Deliver
  |
  v
[Sandbox detonation]
  +-- Execute in multiple environments (Win10, Win11, macOS)
  +-- Monitor: file system changes, registry, network, process creation
  +-- Timeout: 60-120 seconds per environment
  |
  v
[Verdict]
  +-- MALICIOUS --> Quarantine, alert, extract IOCs
  +-- SUSPICIOUS --> Quarantine for analyst review
  +-- CLEAN --> Deliver with dynamic delivery

Workflow 2: URL Defense Time-of-Click

Email with URL arrives
  |
  v
[URL rewritten to Proofpoint URL Defense proxy]
  |
  v
[Email delivered to user]
  |
  v
[User clicks rewritten URL]
  |
  v
[Proofpoint performs real-time analysis]
  +-- Reputation check
  +-- Content analysis
  +-- Sandbox detonation of landing page
  |
  +-- SAFE --> Redirect to original URL
  +-- MALICIOUS --> Block access, show warning page
  +-- SUSPICIOUS --> Show interstitial warning, allow proceed

Workflow 3: TAP Dashboard Monitoring

Daily operations:
  +-- Review TAP Dashboard threat digest
  +-- Check VAP (Very Attacked People) changes
  +-- Review campaign clusters
  +-- Investigate quarantined messages
  +-- Monitor false positive rate
  |
Weekly:
  +-- Analyze threat trends
  +-- Review sandboxing effectiveness
  +-- Tune policies based on FP/FN data
  +-- Update blocked file type list
  |
Monthly:
  +-- Generate executive report from TAP
  +-- Review VAP list with HR/management
  +-- Assess ROI and threat prevention metrics

Back to mukul975/Anthropic-Cybersecurity-Skills (817 security skills) or Agent skills.