About password candidate extraction

Password candidate extraction finds potential passwords within an email message body for password-protected malware objects. When a password is found for a password-protected malware object and the attachment is detected as malicious through MVX analysis, the email is discarded, and the recipient is notified that a threatening email was found. The recipient never sees the email and never is exposed to threats.

Note

Password extraction does not discard any candidate passwords from an email or alter the contents of an email.

Password candidates can be extracted from 7Z, ZIP, LZH, and RAR archive file types and Office and PDF files.

Note

File types added for scanning using the Malware File Associations settings are not considered in the algorithm for password analysis and extraction.

Password candidate extraction uses default logic as well as an optional list of keyword candidates and a list of ignored word candidates to search for the password candidates in the email. Password candidates are also pushed through the Dynamic Threat Intelligence (DTI) Cloud. A final password candidate list is created by combining the passwords that the Email Security - Server appliance parsed from an email with the candidates that you configured using the Web UI or CLI, and the candidates that were pushed from the DTI Cloud.

Password candidates are possible passwords that are used to open a password-protected malware object. Keyword candidates are words that are most likely to be in the vicinity of a password candidate. Keywords are the clues for finding the passwords. Ignored word candidates are words that are excluded from the password candidate list. The same word can be used in both the password candidate list and the keyword candidate list. The same word can also be used in both the keyword candidate list and the ignored word candidate list. However, the same word cannot be used in both the password candidate list and the ignored word list.

Sources for the password candidates list are the email body, the candidates you configured, and data pushed from a secured content update. Sources for the keyword candidates list are custom (customer-defined) keywords, default (Trellix-defined) keywords, and data pushed from a secured content update. Sources for the ignored word candidates list are custom (customer-defined) ignored words and default (Trellix-defined) ignored words.

Note

TheTrellix default keywords are password, pwd, p/w, passwd, passkey, keyword, and passcode.

Password candidate extraction works with emails in English and other languages. The following table lists the content transfer encodings, character sets, content types, and languages this method works with.

Task list for managing password candidate extraction

Complete the steps for managing password candidate extraction in the following order: