What is QuickSand?
Sometimes, along with email attachments, you may find an additional file with the same subject name. The content of this file may look like this:
QuickSand disarmed file "EIZODUI_LS_0112921999_E500000260.pdf"
QuickSand disarmed file "EIZODUI_LS_0112923698_E500000233.pdf"
Why does this file appear?
Office documents and PDF files can contain active content, such as:
- PDFs that include and run JavaScript commands
- Office documents embedding PowerShell scripts or macros
QuickSand Sandbox is the security system that detects and removes this active content from Office and PDF files, preventing potential threats.
What “disarmed” means
The message indicates that the attachments have been disarmed, disabling potentially dangerous features. This ensures the files are safe to open.
In rare cases, this may prevent files with legitimate macros or scripts from working correctly. However, the main goal is to protect users from harmful content.
