Abuse mailbox for facilitating discovery, investigation, and analysis of email-based threats

A system comprising:

• one or more processors configured to:
• determine that a first email is present in a mailbox where emails deemed suspicious are placed for analysis;
• in response to the determination that the first email is present in the mailbox, determine whether the first email is representative of a threat to an enterprise based at least in part by applying a trained model to the first email;
• and
• in response to the determination that the first email represents a threat to the enterprise:
• generate a record of the threat by populating a data structure with information related to the first email;
• and
• apply the data structure to inboxes of a plurality of employees of the enterprise to determine whether the first email is part of a campaign, and in response to the determination that that the first email is part of a campaign, apply a filter associated with the data structure to inbound emails addressed to employees of the enterprise;
• and
• a memory coupled to the one or more processors, wherein the memory is configured to provide the one or more processors with instructions.

A method comprising:

• determining that a first email of a first employee of an enterprise has been placed in a mailbox for analysis;
• establishing that the first email was delivered as part of a business email compromise (BEC) campaign;
• examining, in response to said establishing, an inbox associated with a second employee of the enterprise to identify a second email delivered as part of the BEC campaign;
• and
• remediating the BEC campaign in an automated manner by extracting the second email from the inbox to prevent further interaction with the second email by the second employee.