This article applies to:

• MailMarshal (SEG) 8.2 and above
• PhishFilter 

Question:

• How do I configure and use the PhishFilter with MailMarshal?

Background:

The PhishFilter is a heuristic filter that is aimed specifically at phishing. It looks at many structural and content traits of an email, and is trained on real phishing email samples. It incorporates URLDeep, a phishing URL Classifier based on deep learning technology.

PhishFilter is implemented as a MailMarshal Category Script.

Rules to use PhishFilter are present in the MailMarshal Default Rules 10.0.5 and above. See the MailMarshal Documentation page.

PhishFilter is also provided to all MailMarshal/SEG customers using version 8.2 or above, with current maintenance.

Prerequisites:

The following files must be present in the {Install}\Config directory. These files should be present on all systems that have current product maintenance.

• XML files
  • Phishing.xml (the main category script)
  • PhishFilter.xml (regularly updated filter file)
  • URLDeepFilter.xml (settings for URLDeep)
• Other Files
  • URLDeep.zip
  • DeepEvals.dll
  • Tensorflow.dll

Usage:

See the rules in the most recent MailMarshal Default Rules.

After Anti-Spam rules, but before Blended Threat URL-rewriting, create a category script rule that uses Phishing.xml. 

• You can choose to move the messages to a quarantine folder. For example:
  
  Where the message is Incoming
  Where message is categorized as Phishing
  Move the message to 'Phishing' with release action 'continue processing'
• An alternative to blocking the message outright is to stamp the message with a warning. You could choose this option if false positives are a concern. The PhishFilter aggressively targets suspected phishing messages, and may occasionally flag non-phishing messages. An example rule to stamp a message is:
  
  Where the message is Incoming
  Where message is categorized as Phishing
  Stamp the message with 'Warn Phishing'
  
  
• The 'Warn Phishing' stamp should be applied at the top of the messages. Sample text is:
  
  WARNING: Please proceed with caution. This message may be a phishing attempt intended to steal your personal information. If you were not expecting this message, do not click on any links or attachments until you verify its authenticity.