With Microsoft Defender for Office 365, you can create an attack simulation training to identify vulnerable users and mitigate potential threats before they impact your organization.
Think before you click
Understanding the intricacies of cybersecurity is crucial in today’s digital landscape. Attack simulation training is indispensable for users as it provides hands-on experience in recognizing and defending against potential threats. This proactive approach empowers individuals to enhance their security awareness, identify vulnerabilities, and contribute to a more resilient organizational defense against cyber attacks.
Microsoft Defender for Office 365 provides an attack simulation training if you are licensed for Microsoft Defender for Office 365 Plan 2 (add-on licenses or included in subscriptions such as Microsoft 365 E5). Without the need for third-party phishing simulations, this attack simulation training can be easily set up in the Defender portal.
This blog focuses more on the user part of the attack simulation and is an extension of the Microsoft Learn documentation, which already provides a good explanation of how to set up the attack simulation in the Defender portal. We will definitely have a summary of the configuration part as well.
Start using MDO’s attack simulation training
Step 1: Report message button
You should start by giving your users the ability to report email messages, which is also necessary for this attack simulation training. To do so, you can activate the:
- Built-in Report button (Outlook on the web)
- Microsoft Report Message or Report Phishing add-ins (all Outlook platforms)
Reported messages appear in the User Reported section of the Submissions page, your reporting mailbox, and are visible in the simulation report.
Step 2: Creating an attack simulation training
After the report button is implemented, you can begin creating an attack simulation training in the Microsoft Defender Portal. You have the option to:
- Simulate a phishing attack
- These simulations test your security policies and practices, as well as train your employees to increase their awareness and decrease their susceptibility to attacks.
- Using automated flows for Attack simulation
- Creating a simulation automation is similar to creating an individual simulation, except for the ability to select multiple techniques, payloads, and the automation schedule.
- Training campaigns for Attack simulation
- Instead of creating and launching simulated phishing attacks that eventually lead to training, you can create and assign Training campaigns directly to users.
For now, we will take a deep dive into a Credential Harvest simulation, one of the several social engineering techniques to choose from. Create the Credential Harvest simulation using the steps provided by Microsoft to simulate a phishing attack and select the global payload: Keep Office 365 Password. Upon completion, you should have a simulation in progress.
The basic elements of a simulation are:
-
Select a Social Engineering Technique, such as credential harvesting
-
Select a Payload (phishing emails and web pages that you use to launch simulations)
- Global Payloads: Includes built-in payloads, such as the
Keep Office 365 Passwordpayload - Tenant Payloads: Contains custom payloads, such as a fake email from an executive with the company’s official signature.
- Global Payloads: Includes built-in payloads, such as the
-
Select a Login Page (phish web login page for credential harvesting and link in attachment techniques)
- Global Login Pages: Includes built-in login pages, such as the Microsoft login page.
- Tenant Login Pages: Includes custom login pages, such as a custom Microsoft login page with corporate branding.
-
Select a Phish Landing Page (provides a learning moment for the user after being phished)
- Global Phish Landing Pages: Includes built-in phish landing pages
- Tenant Phish Landing Pages: Includes custom landing pages, such as with corporate branding
-
Who receives the simulated phishing message and on what schedule
- All users or specific users and groups (dynamic distribution groups are not supported)
- Supported groups: distribution and mail-enabled security groups
The best practices of a simulation are:
- Target users: Include all users in your organization
- Exclude users: Import a CSV file that contains all your shared and room mailboxes (also specify your mail-enabled service accounts in this CSV file)
To export these RecipientTypes, you can run the following command in ExchangeOnline PowerShell
Get-Mailbox -RecipientTypeDetails SharedMailbox, RoomMailbox -ResultSize Unlimited | Select-Object PrimarySmtpAddress | Export-CSV <PATH> -NoTypeInformation
Note: You may can see that the excluded users will end up in the report as
FailedToDeliverEmail, this is normal behavior and you can filter them out in the report.
Step 3: Progress of the attack simulation
The attack simulation begins with users receiving credential phishing emails.
Payload:
A user can click on the link, which creates an outbound connection to an adversary-in-the-middle (AiTM) phishing site (the connection does not raise an alert in Defender).
Login Page:
If the user logs in, they will land on the phish landing page that provides a learning moment to the user after getting phished.
Phish Landing Page:
Once the user clicked on the link and logged in, they received an email from notification@attacksimulationtraining.com for each action to complete a training course.
NOTE: You may want to remove the External tag for the notification email. To do so, run the cmdlet
Set-ExternalInOutlook -AllowList "attacksimulationtraining.com"by using the Exchange Online PowerShell module.
The link will take the user to the Defender portal to complete the courses.
The simulation report allows you to analyze how your users performed in the attack simulation.
Conlusion
Despite advanced security measures, phishing tactics continue to evolve, making it difficult to catch every attempt. Thereby user awareness is important because users play a critical role in identifying and avoiding potential threats.