1. A method for detecting and responding to email based propagation of malicious software (malware) in a trusted network comprising: providing a detector decoy email account to serve as generic bait for malicious software for a domain within the trusted network; providing at least one email account for the domain within the trusted network as a detector probe account; generating a policy based infection response rule when the detector decoy email account receives an email from the detector probe account within the trusted network.