The AV-TEST Institute logs over 450,000 new malware variants every single day. Most of them arrive the same way they have for two decades: through email.
Malicious attachments. Links to weaponized sites. Password-protected archives that bypass scanning. HTML smuggling. QR codes. AI-generated social engineering that references real projects and actual colleagues.
The delivery methods evolve. The file types rotate. The social engineering gets sharper. But the fundamental attack chain remains the same: convince someone to open something, write an executable payload to disk, execute it.
Signature-based antivirus operates at the third step. It tries to recognize the payload after it’s already on the system. That recognition depends on having seen the threat before, analyzed it, created a signature, and pushed an update.
The window between a new ransomware release and when your antivirus can detect it can be hours or days. That’s the window where attacks happen.
The Upstream Intervention Point
FileSure Defend operates at step two — before the payload ever reaches the file system.
It doesn’t matter if the malware is brand new. It doesn’t matter if it’s polymorphic, obfuscated, or compiled five minutes ago. It doesn’t matter if the attacker used password-protected archives or ISO files to evade email gateway scanning.
If Outlook tries to write an executable file to disk, FileSure blocks it at the kernel level. If Chrome tries to download a .dll or .ps1 script, the write operation is intercepted and denied.
The phishing email still arrives. The user still clicks the attachment or the link. But the payload never lands. No file on disk means no execution, no encryption, no lateral movement, no exfiltration.
The Rule Configuration
Here’s the exact FileSure rule that stops email-delivered malware:
File name filter: *.exe;*.dll;*.bat;*.cmd;*.ps1;*.vbs;*.js
Program name filter: \outlook.exe;\thunderbird.exe;\winmail.exe;\chrome.exe;\firefox.exe;\msedge.exe;\iexplore.exe
Operations: Write, Create
Drive type: Hard drives, Workstations
Result: Email clients and browsers cannot write executable or script files to local drives. Phishing attachments and drive-by downloads are blocked at the write attempt — no signature required.
This rule doesn’t ask “have we seen this malware before?” It asks “should Outlook be writing a .exe file right now?” The answer is always no.
Why This Works When Signatures Fail
Adaptive Security’s guide catalogs the delivery methods attackers use today: malicious Office macros, weaponized PDFs, HTML smuggling, QR code phishing, password-protected archives that bypass email scanners.
Every single one of those techniques still requires writing a payload to disk before it can execute. That’s not a limitation of current attack methods — it’s a requirement of how Windows works.
FileSure enforces that requirement as a control point. Ransomware can’t encrypt files it never gets to write. Information stealers can’t exfiltrate credentials from memory if they never load into memory. Remote access trojans can’t establish persistence if they never land on the file system.
The article notes that lateral movement across a network can begin in as little as four minutes after initial execution. FileSure prevents the initial execution. The four-minute clock never starts.
Start Protecting Your Systems
You can test this yourself. Install FileSure on a test machine, enable the email client blocking rule, and try to save an executable attachment from Outlook. Watch it get blocked and logged in real time.
Then open a Word document. Watch that operation get recorded. That’s the whole demo. It works exactly like that, every time — on ransomware variants nobody has seen before, because it doesn’t rely on recognizing the threat.
Start your free 21-day trial at bystorm.com.
Source: Malware Delivered Through Email: How It Happens, Key Warning Signs, and Defense Strategies That Work
Category: Threat Intelligence
Tags: email malware, phishing, ransomware delivery, kernel filter driver, file system security, payload blocking, executable file control
