SOP-38: Malware Email Attachment Response

Rudra Verma, Senior Security Architect & Researcher · 2026-07-18

Malware delivered via email attachments (T1566.001 — Spearphishing Attachment) remains the most common initial access vector. Microsoft Defender for Office 365 Safe Attachments detonates attachments in a sandbox before delivery. This SOP covers two scenarios: attachment blocked at detonation (low urgency, ZAP cleanup) and attachment delivered and opened before detonation verdict (high urgency, endpoint triage required).

Email header analysis is essential to confirm whether the sender domain is legitimate or spoofed, and to scope the campaign (how many recipients received the same attachment).

☰ Table of Contents

01 Background 02 Identification 03 Containment 04 Eradication 05 Escalation

🛠

01 — BACKGROUND

TECHNIQUE OVERVIEW

Malware Email Attachment Architecture

T1566.001

Threat actors send malicious attachments in formats that bypass basic AV: password-protected ZIPs, ISO disc images, LNK shortcut files, macro-enabled Office documents, and OneNote embeds. Safe Attachments detonates these in a cloud sandbox; if the detonation produces malicious indicators, the email is re-routed or ZAP-purged if already delivered. The critical time window is the gap between delivery and detonation verdict — typically 2–5 minutes but up to 30 minutes for complex payloads.

Field	Value
MITRE Technique	T1566.001 — Spearphishing Attachment
Log Sources	EmailEvents, EmailAttachmentInfo, OfficeActivity, SecurityAlert
High-Risk Extensions	.iso, .lnk, .one, .docm, .xlsm, .zip (password-protected), .js, .vbs, .hta
Key Alert Types	Safe Attachments blocked, ZAP triggered, Malware campaign detected
Detection Priority	HIGH if user opened attachment — treat as active malware execution

🔍

02 — IDENTIFICATION

2 INDICATORS

▶ Investigation Workflow

Safe Attachments Verdict & Delivery Status

T1566.001

WHY CHECK

The critical decision point is whether the malicious attachment was delivered and opened before Defender for Office 365 issued a ZAP verdict. EmailEvents and EmailAttachmentInfo log the delivery action and the hash of the attachment, enabling scope analysis across all recipients.

📍 Portal Navigation — Defender XDR Advanced Hunting

security.microsoft.com› Hunting› Advanced Hunting

1Navigate to security.microsoft.com → Hunting → Advanced Hunting.
2Paste the KQL below with the attachment filename or SHA256 hash from the alert. Set time range to Last 48 hours.
3Check DeliveryAction: Delivered means the email reached the inbox; Blocked or Replaced means Safe Attachments intercepted it.
4If DeliveryAction = Delivered, check whether the recipient opened the attachment: look for FileCreated or FileRenamed events on the recipient's device in the Device Timeline.
5Note all RecipientEmailAddress values — this is the scope of users who need to be notified and checked.

DeliveryAction	Meaning	Action
Delivered	Email reached inbox — ZAP may have purged post-delivery, check open status	ESCALATE if opened
Blocked	Safe Attachments blocked before delivery — user never received it	Document & close
Replaced	Attachment replaced with warning placeholder — user received email without payload	Document & close
DeliveredAsSpam	Moved to Junk — still accessible, ZAP confirmation needed	Verify ZAP, check access

DETECTS: All recipients of emails containing a specific attachment hash. Returns delivery action and recipient list to scope campaign impact and identify who needs endpoint triage.

KQL — Defender XDR Advanced Hunting (EmailAttachmentInfo)

let AttachHash = "REPLACE_WITH_SHA256_OR_FILENAME"; EmailAttachmentInfo | where Timestamp > ago(48h) | where SHA256 == AttachHash or FileName contains AttachHash | join kind=inner ( EmailEvents | where Timestamp > ago(48h) | project NetworkMessageId, RecipientEmailAddress, DeliveryAction, DeliveryLocation, SenderFromAddress ) on NetworkMessageId | project Timestamp, RecipientEmailAddress, SenderFromAddress, FileName, FileType, DeliveryAction, DeliveryLocation | order by Timestamp desc

DETECTS: Email attachment malware events in Splunk — surfaces emails with malicious attachment verdicts from the mail gateway, grouped by sender and file type.

SPL — Splunk

index=* sourcetype=ms_o365_management_activity Operation=AttachmentMalwareDetected OR (sourcetype=email action=blocked attachment_verdict=malware) | stats count as detections, values(recipient) as recipients, values(sender) as senders, values(attachment_name) as files by subject | sort -detections

Endpoint Triage — Attachment Execution Check

T1566.001

WHY CHECK

If the attachment was delivered and opened, the priority shifts to endpoint triage: did the attachment spawn a child process? Common patterns include Office macros launching PowerShell, LNK files running cmd.exe, and ISO mounts executing embedded binaries. The process tree reveals whether execution occurred.

📍 Portal Navigation — Defender XDR Device Timeline

security.microsoft.com› Assets → Devices› [Device] → Timeline

1Navigate to the affected device in Assets → Devices and open the Timeline tab.
2Filter the timeline to the window around the email delivery timestamp. Look for child processes spawned by WINWORD.EXE, OUTLOOK.EXE, explorer.exe, or mshta.exe.
3Check if powershell.exe, cmd.exe, wscript.exe, or regsvr32.exe launched as a child of the Office application — this confirms macro execution.
4If execution is confirmed, run the KQL below to check for subsequent network connections from the process tree indicating C2 callback.
5Check for persistence: new scheduled tasks, registry Run key modifications, or new startup items created after the attachment was opened.

DETECTS: Office applications spawning suspicious child processes — identifies macro or embedded script execution following email attachment opening. Flags high-risk parent-child process relationships.

KQL — Defender XDR Advanced Hunting

DeviceProcessEvents | where Timestamp > ago(48h) | where InitiatingProcessFileName in~ ( "WINWORD.EXE","EXCEL.EXE","POWERPNT.EXE", "OUTLOOK.EXE","onenote.exe","mshta.exe") | where FileName in~ ( "powershell.exe","cmd.exe","wscript.exe", "cscript.exe","regsvr32.exe","rundll32.exe", "certutil.exe","bitsadmin.exe") | project Timestamp, DeviceName, AccountName, InitiatingProcessFileName, FileName, ProcessCommandLine | order by Timestamp desc

DETECTS: Office document spawning shell processes in Splunk — identifies execution chains from email clients and Office applications to scripting engines.

SPL — Splunk

index=* sourcetype=wineventlog EventCode=4688 parent_process_name IN ("WINWORD.EXE","EXCEL.EXE","OUTLOOK.EXE","onenote.exe") process_name IN ("powershell.exe","cmd.exe","wscript.exe","regsvr32.exe") | table _time host user parent_process_name process_name process_cmd_line | sort -_time

Password-protected ZIP attachments evade Safe Attachments detonation because the sandbox cannot open the archive without the password (which is in the email body). If the alert was triggered by a gateway-level rule rather than a detonation verdict, check the email body for the password and re-assess the threat level.

🚫

03 — CONTAINMENT

IMMEDIATE ACTION

Verdict & Escalation Decision

DECISION GATE

▶ Triage Verdict — Select One

CONFIRMED Attachment opened AND child process (PowerShell/cmd) spawned → Isolate host, escalate to L2 IR, treat as active malware execution

PARTIAL Attachment delivered but no evidence of opening, OR other recipients at risk → ZAP purge all copies, notify recipients, monitor endpoints

FALSE POSITIVE Attachment blocked before delivery AND single isolated email, no other recipients → Document verdict, sender block, close ticket

ZAP Purge & Sender Block

CONTAINMENT

📍 Portal Navigation — Defender XDR Explorer & Threat Policies

security.microsoft.com› Email & Collaboration› Explorer (Threat Explorer)

1Open Threat Explorer → All email. Filter by sender address or attachment hash. Select all matching emails and click Actions → Move to deleted items (ZAP).
2Block the sender domain: Policies & Rules → Threat Policies → Anti-spam → Block list → add sender domain.
3If the host executed the attachment: Devices → [Device] → Actions → Isolate device.
4Notify all affected recipients via a separate channel (Teams/phone) advising them not to open the email if it is still visible in their Deleted Items folder.

🗑

04 — ERADICATION

CLEANUP

Malware Removal & Email Hygiene

ERADICATION

1If host was infected: run full AV scan via Defender Actions, remove malware binary and persistence mechanisms (scheduled tasks, registry run keys).
2Verify ZAP completion: re-run the EmailAttachmentInfo KQL — DeliveryLocation should show Deleted Items or Quarantine for all copies.
3Add the attachment SHA256 hash to Defender for Endpoint Custom Indicators as Block to prevent re-execution on any managed endpoint.
4Submit the attachment to the Defender Threat Intelligence portal for analysis if the malware family is not identified.
5Update the Safe Attachments policy if the file type was not covered: add .iso, .lnk, .one to the blocked extension list if absent.

Eradication Complete When

All copies of email ZAP-purged to Deleted Items or Quarantine
Sender domain blocked in anti-spam policy
Attachment SHA256 added to Defender indicators as Block
Affected host re-scanned clean (if execution occurred)
All recipients notified and confirmed no additional openings

📢

05 — ESCALATION

ESCALATION PATHS

ES1

Escalation Matrix

ESCALATION

Condition	Severity	Action	Notify
Attachment executed, C2 callback confirmed	SEV1	Full IR, isolate host, preserve memory	SOC Lead → CISO → IR Team
Attachment opened, no C2 confirmed yet	SEV2	Isolate host, deep forensic triage	SOC Lead → Security Manager
Campaign: 5+ recipients, ZAP needed	SEV2	Bulk ZAP, comms to users, sender block	SOC Lead → IT Manager
Single delivery, blocked, no opening	SEV4	ZAP, sender block, document, close	Ticket only

For a targeted spearphishing campaign (attachment sent to C-suite or finance), escalate to SEV1 even if the attachment was blocked — the targeting itself indicates an advanced threat actor who will likely retry with a new delivery vector.

Stay Threat-Ready

Follow CyberHawk Threat Intel for daily SOC analyst playbooks, detection engineering guides, and threat intelligence.

📺 YouTube 🎤 TikTok 🐦 X / Twitter 📡 Telegram

All SOPs Blog Web App (Free)

They can't exploit you if you are the Exploit.