Phishing aftercare

This blog is part of our Office 365 attack & defense series. We also maintain a Github page where we share our Office 365 tools and queries. We often get sent phishing emails by family and friends. Not to phish us but because we ask family and friends to forward them to us. Sometimes they also send them to ask us for a second opinion. For us its an interesting insight into what people get sent and sometimes the start of a fun research project. Usually these phishing attempts are a standard and untargeted, sometimes they are clearly an internal phishing test. If a message seems targeted towards a person or organization we always advise them to contact internal IT administration or security departments. Unfortunately people often do not respond positively to this advice. Submitting the message is too complex and there is no feedback whether or not it was malicious.

Handling user-reports

Recently we got another message: “Hey is this right?” including a screenshot of an email. The email described the email storage quota was exceeded. And in the attachments a word document with the instructions on how to fix the quota. The email message used the organization name and so did the filename of the word document. It’s still unclear if this is a phishing test by the organization or an actual phishing attempt. We used this phishing scenario in the past so it did feel like phishing but in the end it didn’t feel right. So I advised to contact their IT department. The immediate response was they didn’t want to do so: the last phishing message they forwarded, returned a snarky response stating they didn’t follow proper procedure. Which is unfortunate: as a defender getting these messages from our colleagues helps us to detect threats. Recently the university of Maastricht was hacked and ransomed. The initial vector: phishing. phishing. Awareness and reporting on its own is obviously not enough but making sure everyone reports if they see something suspicious will help. Next to making it easy to report users need to receive feedback of their report. If someone feels they are contributing they will be more willing to send them in.

Helping users report phishing

Having a quick and easy procedure to receive the messages is important. But we need the original message so we could instruct users to only forward as attachment. But this is not a button that is in the main screen and would require users to click around. As IT we sometimes forget that an employee is not there to act as a human spam filter. So that notification should be made as simple as possible. It is easy for office365 and exchange users to receive notification from users. A user can classify an email as spam or phishing in the web interface. Normally all email will go directly to Microsoft. But it is also possible to receive it yourself. A mail flow rule allows the messages sent to Microsoft to be bcc-ourselves. Now suppose you don’t want Microsoft to receive these messages, you can also choose to redirect the message instead of sending a bcc. How to do this is at the bottom of the article. Technically not very complicated to receive a phishing report. Now it remains for us to inform our colleagues how to report. And providing feedback and the latter can be difficult. Not every report is relevant at all and, depending on the size of the organization, it does not scale to respond 1-on-1. An option could be to include something like this in the newsletter or to raffle something cool under the best phishing submission. It doesn’t really matter, as long as you show that you do something with it!

Configure mailflow:

Setting up the mail flow rule can be done in 2 ways, via the GUI and via powershell.

Via the GUI

1. Log in to the Exchange Admin center
2. Select “email flow”
3. Select “rules”
4. Create a new rule with the following properties:
   • Apply this rule if … Recipient is “[email protected]” or “[email protected]” or “[email protected]”
   • Do the following … BCC or Redirect* the message to “an email address you like”

* the Redirect To options will make sure the Phishing email is not send to Microsoft but to you instead.

PowerShell FTW:

What can be done by hand is easier with PowerShell, replace -BlindCopyTo with -RedirectMessageTo if you don’t want these messages to be sent to Microsoft. The script is also available in our Github repository:

#Modify email adress and rule name below: 
$recipient = "YOUREMAILADRESS"
$name = "[ZOLDER] Recieve user alerts"

New-TransportRule $name -SentTo "[email protected]","[email protected]","[email protected]" -BlindCopyTo $recipient -StopRuleProcessing $false -Mode "Enforce" -Comment "" -RuleErrorAction "Ignore" -SenderAddressLocation "Header"

Bonus

You can add text or html to any email from outside of the company. This allows you to add a warning to emails from external sources. Which could help users identify false messages. We’ve added the script to our Github repository, use it to add this to your o365 environment. You can add your own organisation name, the layout looks like this: Don’t forget to inform users of this change, if they know it’ll be added they will be better prepared to use it.