CIS Controls CIS-9.7

Email-server attachment scanning and sandboxing can identify, quarantine, or remove malicious attachments before they reach the recipient.

Removing a malicious attachment before delivery prevents the user from opening the file and initiating its execution chain. The safeguard is limited to malicious files delivered through the protected email environment.

Email sandboxing can detonate weaponized Office documents, PDFs, archives, and other attachments to identify exploit behavior before delivery.

Email detonation chambers can open suspicious documents and observe attempts to retrieve or execute remote templates and payloads before the message reaches the recipient.

Email scanning can identify suspicious LNK attachments and inspect icon-location or target fields that reference remote payloads.

Anti-malware scanners can compare file headers, MIME types, extensions, and content to detect attachments disguised as benign file formats.

Email-server anti-malware directly addresses malicious attachments.

Blocking malicious attachments prevents one major form of user execution.

Email anti-malware can use static, heuristic, and behavioral analysis to identify obfuscated files before delivery.

Heuristic scanning and sandbox detonation can identify packed executables attached to messages, even when packing changes their static signature.

A sandbox capable of executing active HTML attachments may detect JavaScript that reconstructs and writes a malicious payload to disk.

Attachment scanners and sandboxes can identify malicious payloads hidden within documents, scripts, executables, or other carrier files.

Anti-malware can identify encoded or high-entropy attachments and may block encrypted archives that cannot be inspected.

Email anti-malware capable of recursively unpacking ZIP, RAR, 7z, self-extracting archives, and nested archives can identify malicious files before delivery.

A sandbox that renders SVG attachments and executes their embedded scripts may identify payload construction or malicious follow-on behavior.

Anti-malware analysis can identify malicious attachments whose content, signature, or behavior conflicts with their apparent name or file type.

Email gateways can inspect the complete filename and actual file type rather than relying on the first visible extension, allowing attachments such as invoice.pdf.exe or report.pdf.lnk to be blocked.

Email anti-malware and sandboxing can analyze Visual Basic scripts and macro-enabled attachments and quarantine files that exhibit malicious behavior. This does not prevent Visual Basic abuse originating outside email.

Email anti-malware can block suspicious script attachments before they reach an interpreter. Most command and scripting activity occurs after compromise or through channels unrelated to email.

Email scanning or sandboxing may identify PowerShell script attachments or documents that launch PowerShell.

Email anti-malware may quarantine malicious Python scripts or packed Python payloads sent specifically as email attachments. Python activity originating from installed tools or post-compromise execution remains unaffected.

A sandbox may execute JavaScript, JScript, HTA, HTML, or SVG attachments and identify malicious file creation or process execution. Depends on the email security product supporting active-content detonation.