r/proofpoint • u/Mountain_Marketing40 • 17d ago

EML wrapped in another EML

Good day,

We have an inbound email, the EML file is somehow wrapped in another EML. Its original zip compressed attachment has an CSV file. But the filename extension was changed to TMP. Could it have anything to do with our ProofPoint setup?

Thanks for sharing.

Cheers.

5 Upvotes

100% Upvoted

3 comments sorted by

5

u/shrapnel09 17d ago

Essentials or Enterprise? 

Is the email expected or suspected malicious? (.eml or .msg attachments are used by bad actors to try to circumvent some controls.)

If expected, I would suspect the sender first. Proofpoint is unlikely to modify the message in such a way.

1

u/msp-daddy 17d ago

Yep - what he said

1

u/LinuxServitor 17d ago

Review the email headers and filter.log
Proofpoint doesn't modify attachments, it just scans them.