Wanna Get Malware Out of Emails? CISA’s Latest Research
summary
CISA measures malware in email attachments by harvesting and deduplicating real inboxes (33k and 70k unique files in a university pilot), sending flagged files through static analysis (ReversingLab), dynamic analysis (CrowdStrike Falcon Sandbox), then serial CDR chains (Glasswall, OPSWAT, Purifile) and re-testing; results show 98% reduction by static counts and 52–74% reduction by dynamic behavior (overall claim: 74–98% reduction in malware content), with observed baselines like 2.6 malicious files per 1,000 unique attachments; workflow runs offline or inline and pairs with a virtual browser for web downloads.
AI-written summary · about
chapters (5)
- 0:00Intro
- 0:18Disclaimer
- 14:58Why Serial CDR?
- 24:06Apply at Scale to Measure Controls Effectiveness
- 36:37Your Next Steps - Email and Web Services Security
related talks
01h 03mEffects Malware hunting in Cloud environment
22mMalware Hunting - Using python as an attack weapon
42mKeynote: The Expanding Universe of Cyber Threats
48mCatch me if you can: Building a Web Malware Analyzer using Machine Learning
33mBasic Malware Analysis for Incident Responders
47mWorm Charming: Harvesting Malware Lures for Fun and Profit
54mAnalyzing Emotet infections
48mData-Driven Cyber Indicators of Malicious Insider Threat