applied security research
Rik van Duijn - 26 mei 2020
Phishing aftercare

Handling user-reports
Recently we got another message: “Hey is this right?” including a screenshot of an email. The email described the email storage quota was exceeded. And in the attachments a word document with the instructions on how to fix the quota. The email message used the organization name and so did the filename of the word document. It’s still unclear if this is a phishing test by the organization or an actual phishing attempt. We used this phishing scenario in the past so it did feel like phishing but in the end it didn’t feel right. So I advised to contact their IT department. The immediate response was they didn’t want to do so: the last phishing message they forwarded, returned a snarky response stating they didn’t follow proper procedure. Which is unfortunate: as a defender getting these messages from our colleagues helps us to detect threats. Recently the university of Maastricht was hacked and ransomed. The initial vector: phishing. phishing. Awareness and reporting on its own is obviously not enough but making sure everyone reports if they see something suspicious will help. Next to making it easy to report users need to receive feedback of their report. If someone feels they are contributing they will be more willing to send them in.Helping users report phishing
Having a quick and easy procedure to receive the messages is important. But we need the original message so we could instruct users to only forward as attachment. But this is not a button that is in the main screen and would require users to click around. As IT we sometimes forget that an employee is not there to act as a human spam filter. So that notification should be made as simple as possible. It is easy for office365 and exchange users to receive notification from users. A user can classify an email as spam or phishing in the web interface.
Configure mailflow:
Setting up the mail flow rule can be done in 2 ways, via the GUI and via powershell.Via the GUI
- Log in to the Exchange Admin center
- Select “email flow”
- Select “rules”
- Create a new rule with the following properties:
- Apply this rule if … Recipient is “abuse@messaging.microsoft.com” or “junk@office365.microsoft.com” or “phish@office365.microsoft.com”
- Do the following … BCC or Redirect* the message to “an email address you like”

PowerShell FTW:
What can be done by hand is easier with PowerShell, replace -BlindCopyTo with -RedirectMessageTo if you don’t want these messages to be sent to Microsoft. The script is also available in our Github repository:
#Modify email adress and rule name below:
$recipient = "YOUREMAILADRESS"
$name = "[ZOLDER] Recieve user alerts"
New-TransportRule $name -SentTo "abuse@messaging.microsoft.com","junk@office365.microsoft.com","phish@office365.microsoft.com" -BlindCopyTo $recipient -StopRuleProcessing $false -Mode "Enforce" -Comment "" -RuleErrorAction "Ignore" -SenderAddressLocation "Header"
Bonus
You can add text or html to any email from outside of the company. This allows you to add a warning to emails from external sources. Which could help users identify false messages. We’ve added the script to our Github repository, use it to add this to your o365 environment. You can add your own organisation name, the layout looks like this:
Blogs