Method of detecting potential Arabic phishing emails
A method for detecting Arabic phishing emails includes connecting a log management solution to an email management solution that includes a spam repository and one or more emails. The spam repository includes one or more Indicators of Compromise (IoCs) that is digital information associated with a cyberattack. An IoC index of the log management solution is populated with the IoCs. The log management solution searches the emails using the IoC index and flags one or more potential phishing emails when an email matches an IoC in the IoC index. The log management solution assigns an authenticity score to each of the potential phishing emails and generates a potential phishing email report containing the potential phishing emails and the authenticity score assigned to each of the potential phishing emails. Based on the potential phishing email report, an assigned user performs one or more remediation actions.
1 . A method for detecting Arabic phishing emails, the method comprising:
connecting a log management solution to an email management solution,
wherein the email management solution comprises a spam repository and one or more emails, and wherein the spam repository comprises one or more Indicators of Compromise (IoCs) comprising digital information that has been associated with a cyberattack,
wherein the log management solution comprises an IoC index separate from the spam repository,
wherein the log management solution and the email management solution are implemented through executable instructions stored on a non-transitory computer-readable medium and configured to be executed by a computer processor of a computer system,
wherein the one or more emails have bypassed pre-delivery email security measures and remained accessible in an inbox of an end user of the email management solution;
populating an IoC index of the log management solution with the one or more IoCs of the spam repository;
searching, by the log management solution, the one or more emails of the email management solution using the IoC index;
flagging, by the log management solution, one or more potential phishing emails from the one or more emails, wherein each of the one or more potential phishing emails matches an IoC of the one or more IoCs in the IoC index;
assigning, by the log management solution, an authenticity score to each of the one or more potential phishing emails;
generating, by the log management solution, a potential phishing email report containing the one or more potential phishing emails and the authenticity score assigned to each of the one or more potential phishing emails; and
performing, by an assigned user, one or more remediation actions based on the potential phishing email report.
2 . The method of claim 1 , wherein each of the one or more IoCs is obtained from a confirmed Arabic phishing email.
3 . The method of claim 1 , wherein populating the IoC index is done repeatedly on a regular basis.
4 . The method of claim 1 , further comprising:
isolating the one or more potential phishing emails such that the end user of the email management solution cannot access the one or more potential phishing emails.
5 . The method of claim 1 , wherein searching the one or more emails is done repeatedly on a regular basis.
6 . The method of claim 1 , wherein the authenticity score is based on a domain age of each of the one or more potential phishing emails and a domain reputation of each of the one or more potential phishing emails.
7 . The method of claim 6 , wherein the domain reputation is determined through an email authentication technique such as Sender Policy Framework (SPF).
8 . The method of claim 1 , further comprising:
delivering, by the log management solution, the potential phishing email report to the assigned user of the log management solution; and
analyzing, by the assigned user, each of the one or more potential phishing emails in the potential phishing email report to determine when each of the one or more potential phishing emails is a confirmed phishing email, wherein the authenticity score is used in the analyzing.
9 . The method of claim 1 , wherein a remediation action is one of a following group of remediation actions: to permanently remove a confirmed phishing email from the email management solution, to update the spam repository with one or more new IoCs obtained from the confirmed phishing email, to inform the end user of the email management solution about the confirmed phishing email, to perform a security screening on a receiving computer system of the confirmed phishing email, to block incoming email that contains one or more new IoCs obtained from the confirmed phishing email, and to release a confirmed safe email that had previously been isolated from a user of the email management solution.
10 . A system for detecting Arabic phishing emails, the system comprising:
an email management solution comprising a spam repository and one or more emails, wherein the spam repository comprises one or more Indicators of Compromise (IoCs) comprising digital information that has been associated with a cyberattack,
wherein the one or more emails have bypassed pre-delivery email security measures and remained accessible in an inbox of an end user of the email management solution; and
a log management solution comprising an IoC index separate from the spam repository, the log management solution configured to:
connect to the email management solution;
populate the IoC index of the log management solution with the one or more IoCs of the spam repository;
search the one or more emails of the email management solution using the IoC index;
flag one or more potential phishing emails from the one or more emails, wherein each of the one or more potential phishing emails matches an IoC of the one or more IoCs in the IoC index;
assign an authenticity score to each of the one or more potential phishing emails;
generate a potential phishing email report containing the one or more potential phishing emails and the authenticity score assigned to each of the one or more potential phishing emails; and
deliver the potential phishing email report to an assigned user of the log management solution,
wherein the log management solution and the email management solution are implemented through executable instructions stored on a non-transitory computer-readable medium and configured to be executed by a computer processor of a computer system.
11 . The system of claim 10 , wherein each of the one or more IoCs is obtained from a confirmed Arabic phishing email.
12 . The system of claim 10 , wherein populating the IoC index is done repeatedly on a regular basis.
13 . The system of claim 10 , wherein the log management solution is further configured to:
isolate the one or more potential phishing emails such that the end user of the email management solution cannot access the one or more potential phishing emails.
14 . The system of claim 10 , wherein searching the one or more emails is done repeatedly on a regular basis.
15 . The system of claim 10 , wherein the authenticity score is based on a domain age of each of the one or more potential phishing emails and a domain reputation of each of the one or more potential phishing emails.
16 . The system of claim 15 , wherein the domain reputation of the domain of the sender is determined through an email authentication technique such as Sender Policy Framework (SPF).