Outbreak Filter Quarantines Clean Invoices While Encrypted ZIPs Arrive
State university with 30,000 mailboxes runs an ESA cluster with Sophos antivirus, IronPort Anti-Spam, Outbreak Filters, and graymail detection. At 09:10 a Talos outbreak rule flags PDF attachments containing a URL pattern; the outbreak filter is set to quarantine with a threshold of 3 and a 24-hour retention. By 11:00, 240 messages from a new student-billing vendor are in the outbreak quarantine; users report missing invoices. The vendor's PDFs are clean and reachable. Meanwhile, a separate wave of password-protected ZIP files with .js payloads is reaching inboxes; antivirus logs show 'unscannable' but no block. The help desk asks whether to release all 240 messages and disable outbreak filters.
1. Why were the clean PDF invoices quarantined, and how would you safely handle the 240 messages?
Read the worked answer
Outbreak Filters are not just antivirus. They use Talos outbreak rules and URL reputation to catch messages before signature-based AV catches them. A new vendor domain, a newly observed URL pattern, or a PDF URL that matches an active rule can trigger quarantine even when the file itself is clean. The threshold of 3 controls how aggressively the rule is applied; it does not prove malware.
Safe handling:
- Review a sample in the outbreak quarantine, including URL reputation and the rule that matched.
- Release the 240 messages if the vendor and URLs are confirmed legitimate, rather than disabling Outbreak Filters globally.
- Consider a scoped exception for the verified vendor domain or IP, with an expiry date, if the rule continues to false-positive.
- Tune threshold and retention only after measuring the false-positive rate; a lower threshold can increase false positives.
- Keep the outbreak rule active for other senders; document the exception.
Disabling Outbreak Filters would remove early protection against fast-moving campaigns and is not justified by this false positive.
2. What should be done about the password-protected ZIP files showing as unscannable?
Read the worked answer
Antivirus engines generally cannot inspect encrypted archives because the content is inaccessible without the password. An 'unscannable' result is not a clean verdict. If the ESA is configured only to log unscannable messages, the ZIPs will continue to inboxes.
Recommended controls:
- Configure the antivirus or content-filter action for unscannable attachments to quarantine, not deliver.
- Add a content filter that matches encrypted or password-protected archive attachments and quarantines them for administrator review.
- If business requires encrypted archives, provide a managed decryption or password-submission process rather than allowing unscanned delivery.
- Verify the file-type rules cover .zip and that the action applies to all relevant mail policies.
Do not rely on the outbreak filter alone for this gap; the failure is at the AV inspection layer. Test with a known password-protected ZIP after the change.