Insights

Having configured Integrations with your mailboxes and mail controls, every delivr.to campaign you send will provide rich detail into the emails that made it to your inbox, the state in which they arrived, and the assessment of them as they travel through each stage of your mail stack.

To highlight the most notable findings, your campaign results include Insights. These cover everything from:

Key payload delivery results: For example, the successful delivery of a prevalent malware family we’ve recreated.
Indication of mail control performance: Which tools blocked or flagged most emails? Which rules or signatures were most effective?
Attack surface reduction opportunities: Which uncommon file types known to be weaponised by threat actors could potentially be blocked?

An exhaustive list of the insights available to users can be seen below. Users with Trial subscriptions are limited to Informational insights only.

If there’s an insight you’d like to see added to the platform, contact us!

Legend

	High Severity
	Medium Severity
	Low Severity
	Informational
	Negative Outcome
	Positive Outcome

Body

	Name	Campaign Type	Severity	Outcome
	Brand Impersonation: Body content delivered	Email

Containers

	Name	Campaign Type	Severity	Outcome
	Containers: All password-protected zip attachments blocked	Email
	Containers: Password-protected zip attachments permitted	Email

Executables

	Name	Campaign Type	Severity	Outcome
	Executables: All PowerShell scripts blocked	Email
	Executables: All executable files blocked	Email
	Executables: Executable files permitted	Email
	Executables: PowerShell scripts permitted	Email
	Web: Executable files downloaded	Web
	Web: Executable files written to disk	Web

File Types

	Name	Campaign Type	Severity	Outcome
	Attachments: Extensions successfully delivered	Email
	Attachments: High-risk attachment types permitted	Email
	Web: Extensions successfully downloaded	Web

HTML Smuggling

	Name	Campaign Type	Severity	Outcome
	HTML Smuggling: HTML Smuggling payload delivered	Email
	HTML Smuggling: Potentially unwanted attachment types permitted	Email
	HTML Smuggling: SVG Smuggling payload delivered	Email

Integrations

	Name	Campaign Type	Severity	Outcome
	Integration: Breakdown of Defender Org-level Policies	Email
	Integration: Breakdown of Defender User-level Policies	Email
	Integration: Breakdown of Defender signatures flagged	Email
	Integration: Breakdown of Sublime rules flagged	Email
	Integration: Emails blocked by Defender 365	Email
	Integration: Emails blocked by Sublime	Email
	Integration: Emails flagged by Sublime	Email

Links

	Name	Campaign Type	Severity	Outcome
	Links: Active content fetch origins	Email
	Links: All actively fetched	Email
	Links: All rewritten	Email
	Links: Inconsistent rewrites	Email
	Links: No active content fetching	Email
	Links: Not rewritten	Email
	Links: SMB link delivered	Email
	Links: search-ms link delivered	Email
	Web: Files blocked by Safe Browsing	Web

Office

	Name	Campaign Type	Severity	Outcome
	Office: All password-protected Office attachments blocked	Email
	Office: Password-protected Office attachments permitted	Email
	Office: Potentially unwanted attachment types permitted	Email
	Office: Word remote template injection attachment delivered	Email

QR Codes

	Name	Campaign Type	Severity	Outcome
	Attachments: QR code payload delivered	Email

Threat Intel

	Name	Campaign Type	Severity	Outcome
	Threat Intel: APT28 payload delivered	Email
	Threat Intel: APT28 payload passed proxy	Web
	Threat Intel: APT28 payload written to disk	Web
	Threat Intel: APT29 attachment delivered	Email
	Threat Intel: APT29 payload passed proxy	Web
	Threat Intel: APT29 payload written to disk	Web
	Threat Intel: Agent Tesla attachment delivered	Email
	Threat Intel: Agent Tesla payload passed proxy	Web
	Threat Intel: Agent Tesla payload written to disk	Web
	Threat Intel: Amatera Stealer payload delivered	Email
	Threat Intel: Amatera Stealer payload passed proxy	Web
	Threat Intel: Amatera Stealer payload written to disk	Web
	Threat Intel: AsyncRat attachment delivered	Email
	Threat Intel: AsyncRat payload passed proxy	Web
	Threat Intel: AsyncRat payload written to disk	Web
	Threat Intel: Atomic Stealer payload delivered	Email
	Threat Intel: Atomic Stealer payload passed proxy	Web
	Threat Intel: Atomic Stealer payload written to disk	Web
	Threat Intel: BumbleBee attachment delivered	Email
	Threat Intel: BumbleBee payload passed proxy	Web
	Threat Intel: BumbleBee payload written to disk	Web
	Threat Intel: CVE-2024-21413 delivered	Email
	Threat Intel: Callback phishing attachment delivered	Email
	Threat Intel: Callback phishing payload passed proxy	Web
	Threat Intel: Callback phishing payload written to disk	Web
	Threat Intel: DarkGate attachment delivered	Email
	Threat Intel: DarkGate payload passed proxy	Web
	Threat Intel: DarkGate payload written to disk	Web
	Threat Intel: Gamaredon Group attachment delivered	Email
	Threat Intel: Gamaredon Group payload passed proxy	Web
	Threat Intel: Gamaredon Group payload written to disk	Web
	Threat Intel: Gootloader payload delivered	Email
	Threat Intel: Gootloader payload passed proxy	Web
	Threat Intel: Gootloader payload written to disk	Web
	Threat Intel: IcedID payload passed proxy	Web
	Threat Intel: IcedID payload written to disk	Web
	Threat Intel: IcedId attachment delivered	Email
	Threat Intel: LOTUSHARVEST payload delivered	Email
	Threat Intel: LOTUSHARVEST payload passed proxy	Web
	Threat Intel: LOTUSHARVEST payload written to disk	Web
	Threat Intel: Lumma Stealer payload delivered	Email
	Threat Intel: Lumma Stealer payload passed proxy	Web
	Threat Intel: Lumma Stealer payload written to disk	Web
	Threat Intel: Pikabot attachment delivered	Email
	Threat Intel: Pikabot payload passed proxy	Web
	Threat Intel: Pikabot payload written to disk	Web
	Threat Intel: Poseidon Stealer payload delivered	Email
	Threat Intel: Poseidon Stealer payload passed proxy	Web
	Threat Intel: Poseidon Stealer payload written to disk	Web
	Threat Intel: QakBot attachment delivered	Email
	Threat Intel: QakBot payload passed proxy	Web
	Threat Intel: QakBot payload written to disk	Web
	Threat Intel: Sandworm payload delivered	Email
	Threat Intel: Sandworm payload passed proxy	Web
	Threat Intel: Sandworm payload written to disk	Web
	Threat Intel: SmokeLoader payload delivered	Email
	Threat Intel: SmokeLoader payload passed proxy	Web
	Threat Intel: SmokeLoader payload written to disk	Web
	Threat Intel: SocGholish attachment delivered	Email
	Threat Intel: SocGholish payload passed proxy	Web
	Threat Intel: SocGholish payload written to disk	Web
	Threat Intel: Star Blizzard payload delivered	Email
	Threat Intel: Star Blizzard payload passed proxy	Web
	Threat Intel: Star Blizzard payload written to disk	Web
	Threat Intel: Stealth Falcon payload delivered	Email
	Threat Intel: Stealth Falcon payload passed proxy	Web
	Threat Intel: Stealth Falcon payload written to disk	Web
	Threat Intel: Tycoon 2FA payload delivered	Email
	Threat Intel: Tycoon 2FA payload passed proxy	Web
	Threat Intel: Tycoon 2FA payload written to disk	Web
	Threat Intel: Ursnif payload delivered	Email
	Threat Intel: Ursnif payload passed proxy	Web
	Threat Intel: Ursnif payload written to disk	Web
	Threat Intel: Void Banshee payload delivered	Email
	Threat Intel: Void Banshee payload passed proxy	Web
	Threat Intel: Void Banshee payload written to disk	Web