Message platform for automated threat simulation, reporting, detection, and remediation
The present invention relates to methods, network devices, and machine-readable media for an integrated environment and platform for automated processing of reports of suspicious messages, and further including automated threat simulation, reporting, detection, and remediation, including rapid quarantine and restore functions.
1. A computerized method for suspicious message processing and incident response, comprising:
receiving a report at a threat detection platform of a potentially suspicious message delivered into a user account, the report being generated as a result of an action by the user indicating that the message has been identified by the user as a potential security threat, and
wherein the report having been initiated by a user interface element in an email client, and
wherein the report comprises a copy of the delivered message;
electronically storing defined textual or binary patterns associated with at least one security threat;
processing the received message according to the electronically stored patterns to determine if the body of the received message or an attachment of the received message contains the defined textual or binary patterns associated with the security threat;
if the received message contains the defined textual or binary patterns associated with the security threat, then:
transmitting a message identifier and associated account identifier for the received message to an email server in association with a command to move the received message from an inbox associated with the user account;
generating a copy of the received message, the copy having been modified such that the security threat has been replaced with innocuous content or deleted;
establishing a privileged account connection to an administrative account on the email server to access multiple user email accounts; and
using the privileged account, inserting the copy of the message having been modified into one or more of the accessed multiple user email accounts.
2. The method of claim 1 , wherein the inserting of the copy is performed only after a user activity action has been detected on the one or more multiple user email accounts.
3. The method of claim 1 , further comprising:
transmitting a command to the email server to return one or more message identifiers and associated account identifiers for other messages having the common characteristic;
receiving the message identifiers and account identifiers for the other messages having the common characteristic;
transmitting the message identifiers and account identifiers to the email server in association with a command to move the messages from user account inboxes.
4. The method of claim 1 , further comprising:
at the email server:
receiving copies of incoming email messages;
parsing the incoming email messages into Multipurpose Internet Mail Extension components; and
storing the message components in a data store, each of the messages components being stored as a separate field in a database in the data store, each of the fields being stored in association with a unique message identifier for the message.
5. A computerized system for suspicious message processing and incident response, comprising:
a processor at a threat detection platform configured with executable instructions for:
receiving a report at a threat detection platform of a potentially suspicious message delivered into a user account, the report being generated as a result of an action by the user indicating that the message has been identified by the user as a potential security threat, and
wherein the report having been initiated by a user interface element in an email client, and
wherein the report comprises a copy of the delivered message;
electronically storing defined textual or binary patterns associated with at least one security threat;
processing the received message according to the electronically stored patterns to determine if the body of the received message or an attachment of the received message contains the defined textual or binary patterns associated with the security threat;
if the received message contains the defined textual or binary patterns associated with the security threat, then:
transmitting a message identifier and associated account identifier for the received message to an email server in association with a command to move the received message from an inbox associated with the user account;
generating a copy of the received message, the copy having been modified such that the security threat has been replaced with innocuous content or deleted;
establishing a privileged account connection to an administrative account on the email server to access multiple user email accounts; and
using the privileged account, inserting the copy of the message having been modified into one or more of the accessed multiple user email accounts.
6. The system of claim 5 , wherein the inserting of the copy is performed only after a user activity action has been detected on the one or more multiple user email accounts.
7. The system of claim 5 , further comprising instructions for:
transmitting a command to the email server to return one or more message identifiers and associated account identifiers for other messages having the common characteristic;
receiving the message identifiers and account identifiers for the other messages having the common characteristic;
transmitting the message identifiers and account identifiers to the email server in association with a command to move the messages from user account inboxes.
8. The system of claim 5 , further comprising instructions for:
at the email server:
receiving copies of incoming email messages;
parsing the incoming email messages into Multipurpose Internet Mail Extension components; and
storing the message components in a data store, each of the messages components being stored as a separate field in a database in the data store, each of the fields being stored in association with a unique message identifier for the message.