AutoSpamEmailScan

Author(s)

• HAO BAN/banhao@gmail.com

Functions

Google-Safe-Browsing Submit-URLSCAN Submit-URL-Virustotal Submit-FILE-OPSWAT FromEmailAttachment ConvertLogToHTML ExtractURLFromPDFHTML CheckRedirectedURL extract_hyperlink_from_Excel MAIN

Dependencies

This script has no dependencies.

Release Notes

Creation Date:  <11/08/2022>
Purpose/Change: Remove module "EncodedHTML". Add BANNER. Add module check.
Creation Date:  <09/21/2022>
Purpose/Change: Add Hash Value into MineMeld when the attachment scan result is positive
Creation Date:  <09/09/2022>
Purpose/Change: Add module "EncodedHTML"
Creation Date:  <08/17/2022>
Purpose/Change: Add module "extract_hyperlink_from_Excel"
Creation Date:  <06/10/2022>
Purpose/Change: optimize some outputs format.
Creation Date:  <05/31/2022>
Purpose/Change: Rename some variables.
Creation Date:  <05/30/2022>
Purpose/Change: Optimize the module "CheckRedirectedURL", skip scan the URL if the URL contain file types in variable "$EXTENSIONARRAY"
Creation Date:  <05/26/2022>
Purpose/Change: Add "RedirectURL.py" to replace the powershell script.
Add "pdf2url.py" to replace the "Bytescout.PDF2HTML.dll"
Add "Submit_FILE_Virustotal.py" to replace the "Submit-FILE-Virustotal" and call VirusTotal V3 API
Creation Date:  <05/09/2022>
Purpose/Change: Add "selenium_simulator.py" to open HTML file on local and get screenshot.
Creation Date:  <05/03/2022>
Purpose/Change: optimize the method to extract email address from the mail body.
Creation Date:  <04/28/2022>
Purpose/Change: Instead the "Cisco SecureX Investigation Module" with the "secureX.ps1"
Add "MineMeld_Indicator.ps1"
Add ESA_Spam_Block.ps1
Remove "checkphish.ai" module
Creation Date:  <09/20/2021>
Purpose/Change: Fixed Function "ESASpamQuarantine" a small bug.
Creation Date:  <07/08/2021>
Purpose/Change: add Cisco SecureX Investigation Module
Creation Date:  <05/26/2021>
Purpose/Change: Fixed some bugs
Creation Date:  <05/19/2021>
Purpose/Change: Add "BlockedMailSelfRelease" function. If you donnot have ESA/SMA or donott want to use ESA/SMA API to block SPAM sender or release blocked emails from quarantine then please setup "ENABLEESASPAMBL" and "ENABLESELFRELEASE" as "False" in init.conf
Creation Date:  <05/13/2021>
Purpose/Change: Add "slblconfig EXPORT" after update the Cisco Email Security Appliance Spam Quarantine Blacklist.(related to Cisco Bug CSCvx12488)
ssh PRIVATE KEY must be save in "c:\users\<username>\.ssh\" folder. ".ssh" folder must disable "inheritance" and manually grant "local\SYSTEM" group, "local\Administrators" group "full control" privilege, and current user "read only" privilege.
Creation Date:  <04/05/2021>
Purpose/Change: Optimize function CheckRedirectedURL{}
Creation Date:  <03/25/2021>
Purpose/Change: Update function CheckRedirectedURL{}
Creation Date:  <03/19/2021>
Purpose/Change: Add a new module for Cisco Email Security Appliance Spam Quarantine Blacklist.
Creation Date:  <11/10/2020>
Purpose/Change: Move emails to sub-folder when after the checking.
Creation Date:  <04/03/2020>
Purpose/Change: Optimize the parameters setting.
Creation Date:  <04/02/2020>
Purpose/Change: Add new feature to let the use input the credential just chose "N" when prompt "salt is empty". Add SystemException, fix the broken of the system error.
Creation Date:  <03/10/2020>
Purpose/Change: Add a new Function CheckRedirectedURL, this feature is used to detect URLs that try to escape the scan.
Change "function Submit-URL-Virustotal" to use the VirusTotal API V3
Creation Date:  <02/11/2020>
Purpose/Change: Add checkphish.ai API limit error
Creation Date:  <01/22/2020>
Purpose/Change: Add a new Function checkphish.ai
Creation Date:  <10/21/2019>
Purpose/Change: One funcation name was changed but calls the old name in the program. Update the Bytescout.PDF2HTML.dll to version 10.6.0.3667. It's still a trial version and will expire after 90 days. If you see this error:
--------------------------------------------------------------------------------------
"new-object : Exception calling ".ctor" with "0" argument(s): "Trial period expired."
+         $extractor = new-object Bytescout.PDF2HTML.HTMLExtractor
--------------------------------------------------------------------------------------
That means the DLL file has been expired.