Attachment Threat Protection User Guide - VES

How does ATP affect me?

ATP, like other VIPRE Email Security software, acts in the background to protect you. In a perfect world, no one would ever try to send you a harmful file. However, we know better. Harmful files are transferred as attachments through email all the time, including viruses, Trojans, adware, and other forms of malware. Some of these are caught by signature-based checks, particularly if they are files that have been seen before by other people. ATP scans new, unknown email attachments , flags newly-identified harmful items, and delivers this information in your Email Security Quarantine Report.

What types of attachments does ATP scan?

In short, executable files, archives, and documents that can contain macros or malicious code. See our Admin Guide for more information on Supported attachment types.

What happens to my emails when ATP checks them?

If an email does not contain any attachments or only non-supported attachments, it is delivered to you immediately (after all the standard Email Security checks, such as anti-spam).

If an email message contains supported attachment types , each attachment is extracted from the email and "detonated" (i.e., executed) within an isolated sandbox virtual machine. Advanced AI technology analyzes the attachment's behavior. This process does take some time, and processing time may depend on how many of your peers have also recently received emails with attachments.

If the attachments are clean, you’ll receive your original email with the attachments, as usual.

If an email message contains attachments that are identified as potential malware by ATP, those items are sent to quarantine just like other undesired content. You'll find these items on your Quarantine Report, which shows all suspect emails and potentially malicious file attachments. If you do not receive a Quarantine Report, check with your administrator.

In the special case where an email with attachments takes a very long time to process, you may receive a "pre-notification" email that consists of the original email with attachments stripped off of it. This notification is intended to alert you to a pending message from the sender that is "in queue". You may be able to respond based solely on the email content without the attachments, or you can wait for the final result of the ATP scan. If the attachments are clean, ATP re-delivers the original email with all attachments intact.

As part of this process, you may see that your email has:

• A subject beginning with [SANDBOX]
• Its original attachments removed, with a text list of attachment filenames instead
• A warning at the bottom. See Warnings generated by ATP

What's the difference between a suspect and malicious attachment?

ATP uses advanced sandbox technology to test files within a virtual environment and see if they attempt to perform harmful activities or otherwise act suspiciously. The behavior of the attachment under test is compared to the past observed behavior of millions of known malware samples and known benign samples. This comparison is a statistical analysis and hence necessarily involves a similarity rating within a range.

• A suspect attachment is one which has exhibited odd (but not immediately harmful) behavior. It may have attempted to take action without permission, like open a web page or launch other programs, or it may have performed other suspicious activities that have similarly been observed in other malware. Not all suspect files are bad, but they have performed actions that are typically unexpected in well-behaving software.
• A malicious attachment is one that either contains other known malware, or attempted to perform malware-like actions. It clearly attempted to infect or damage a user's PC to some degree during testing or clearly exhibits behavior very similar to other malware.

Malicious attachments are quarantined and cannot be released due to the risk they pose; suspect attachments are also quarantined but may be released on your personal recognizance (if your admin has granted permission). We do NOT recommend releasing suspect attachments unless you know and trust the sender, or have proper protections in place for testing of the attachment.

"This email contains one or more attachments that have been temporarily removed while we check them for malicious code."

The full text of the message is

This email contains one or more attachments that have been temporarily removed while we check them for malicious code. We will redeliver the email with any original attachments once processing is complete.

Please exercise caution if you choose to release this email before it is checked.

"This email contains multiple attachments which could not be checked for malicious code."

The full text of the message is

This email contains multiple attachments which could not be checked for malicious code. Please exercise caution when opening any attachments to this message.