Protecting the perimeter with VT Intelligence - Email security

This post provides a step-by-step method to hunt phishing attachments with VirusTotal Intelligence, starting from basic filters (document type, attachment tag, submitter geography, AV positives, recent first-seen) and building to advanced conditions (high submission counts for potential mass campaigns, identifying AV blindspots, and boolean logic). It emphasizes spotting risky behaviors during sandbox detonation, such as PowerShell execution and macro-triggered file retrieval, to surface likely malicious emails and reduce reliance on end-user detection.