Re: Analyzing Suspicious Attachment

[zenmasterbob123 () gmail com]

I can't agree strongly enough with this course of action.  There is really no more effective way of knowing what your 
little intruder is going to do than to put it on a replica of a production machine, on an isolated network segment, and 
then do what an undereducated user would do, (i.e., double-click the file).  Turn on all the logging you can stand, and 
watch what happens.

Not only does it give you some information about the attack (and possibly your attacker, if it wasn't random), but it 
gives you a great visual aid the next time you run a user education event.