How Darktrace / EMAIL Analyzes and Responds to a Malicious Email
Summary
Darktrace describes how its email security product processes a sample extortion email, from extracting message data and analyzing user behavior to identifying a campaign and holding related emails.
Key points
- The example extortion email passed SPF, DKIM, and DMARC checks, but the system continued analyzing it.
- The product extracts email headers and content, then uses historical data and mailbox behavior to identify anomalies.
- Metrics include language-based extortion detection and identification of sensitive data.
- A model flagged the example based on its extortion score and bitcoin wallet address, triggering a hold on the message.
- Campaign clustering can identify related emails and apply a hold to campaign messages retroactively.
- The system combines alerts and anomaly scores in its interface for security teams to investigate.
Article Details
- Topic
- How Darktrace / EMAIL uses multi-layered AI to analyze emails, detect threats, and apply autonomous actions