Abnormal Security Threat Detection & Analysis

Overview

Abnormal Security uses behavioral AI to detect email threats that bypass traditional secure email gateways (SEGs). Unlike signature or rule-based detection, Abnormal profiles normal communication patterns and detects deviations indicative of attacks. This skill covers threat types, attack vectors, severity assessment, remediation, and investigation workflows.

Threat Types

Detection Approach

Threat Field Reference

Core Fields

Sender Fields

Recipient Fields

Remediation Fields

MCP Tools

Tool Usage Examples

List recent threats:

{
  "tool": "abnormal_threats_list",
  "parameters": {
    "fromDate": "2026-03-20T00:00:00Z",
    "toDate": "2026-03-27T00:00:00Z",
    "pageSize": 25
  }
}

Get threat details:

{
  "tool": "abnormal_threats_get",
  "parameters": {
    "threatId": "184def76-3c28-4e1b-9ef0-a5abc123def4"
  }
}

Remediate a threat:

{
  "tool": "abnormal_threats_remediate",
  "parameters": {
    "threatId": "184def76-3c28-4e1b-9ef0-a5abc123def4",
    "action": "QUARANTINE"
  }
}

Threat Investigation Workflows

BEC Investigation Workflow

1. Review threat details - Check attackType, attackStrategy, summaryInsights
2. Analyze impersonation:
   • Who is being impersonated (impersonatedParty)
   • Display name vs actual email address mismatch
   • Reply-to vs from address mismatch
   • First-time sender or unusual communication pattern
3. Check financial indicators:
   • Wire transfer, ACH, or gift card requests
   • Invoice or payment redirection
   • Urgency language ("urgent", "today", "confidential")
4. Assess scope:
   • Search for same sender across all recipients
   • Check if other users received similar attacks
5. Remediate:
   • Quarantine message if still in inbox
   • Alert targeted recipients directly
   • Block sender domain if confirmed malicious
6. Document - Record findings and IOCs

Credential Phishing Investigation Workflow

1. Get threat details - Focus on attackVector and embedded URLs
2. Analyze URLs:
   • Check for brand impersonation (Microsoft, Google, Dropbox)
   • Look for redirect chains and URL shorteners
   • Identify credential harvesting pages
3. Check sender authentication:
   • SPF, DKIM, DMARC results
   • Domain age and reputation
4. Assess user interaction:
   • Was the email read (isRead)?
   • Was it post-remediated (delivered then removed)?
5. Remediate:
   • Quarantine all instances
   • Force password reset if credentials may have been entered
   • Block phishing domain

Malware Investigation Workflow

1. Get attachment details - File name, type, size
2. Review AI insights - Check summaryInsights for behavioral indicators
3. Assess delivery:
   • Was the attachment opened?
   • How many users received the same attachment?
4. Remediate:
   • Quarantine all instances across the organization
   • Block file hash at endpoint level
   • Isolate affected endpoints if attachment was executed

Severity Assessment Matrix

Remediation Actions