Attack Simulator for Office 365

Microsoft has released Attack Simulator [See full GA Announcement 4/27/2018 here] to allow Office 365 Global Administrators to simulate phishing campaigns and other attack simulations.

The obvious value is finding out which users are most susceptible to phishing attacks so that you can educate them before an actual attacker exploits them.

Prerequisites

  • Your organization’s email is hosted in Exchange Online (Attack simulator is not available for on-premises email servers)
  • You have an E5 license, or have signed up for an E5 trial license (here), or an Office 365 Threat Intelligence Trial (here)
  • You have the security administrator role or Global Administrator role assigned to you
  • You have multi-factor authentication enabled (make sure to first read the MFA prerequisites here, such as enabling oAuth via powershell)

Getting Started

To access Attack Simulator, in the Security & Compliance Center, choose Threat management > Attack simulator. Or you can browse to it directly here:

https://protection.office.com/#/attacksimulator

There are currently three attacks offered by Attack Simulator:

  1. Display name spear-phishing attack
  2. Brute Force password attack
  3. Password spray attack

In this blog post we will quickly cover the first simulation. Feel free to click on the documentation link in the reference table below to read about the other two attack simultaneous.

Display name spear-phishing attack

One of the more common and successful phishing methods is to spoof the Display Name field in Outlook. This is very effective because Sender Policy Framework (SPF) only protects the RFC 5321.Mail From field, and does not protect against spoofing of the Display Name. Only Domain-based Message Authentication, Reporting & Conformance (“DMARC” – RFC 7489) protects against the Display Name field (RFC 5322.From Field). However, since very few organizations have implemented DMARC, then this simulated phishing attack is very effective.

Carrying out the phishing simulation is a straight-forward wizard in the documentation found (here). Basically you enter the email address that you want to spoof and the targeted users that you want to send the fake email to. You can pick from a few pre-built templates, then you can do some customization of the email that would be sent out. After running the campaign, you can monitor to see which users clicked on the link, and which users went a step further and gave away their credentials.

Behind the scenes

Penetration testers may be tempted to try Attack Simulator against other tenants, but Microsoft has thought of that and restricts Attack Simulator to only attack its own tenant.

Another temptation would be to use Attack Simulator to test the effectiveness of your anti-spam technologies (ATP or EOP). However, Attack Simulator is designed to bypass EOP and ATP, which you can confirm by looking at the Message Trace in Exchange Online control panel (http://outlook.com/ecp), as you won’t find any traces of Attack Simulator in the message trace, and therefore it is apparent that it bypasses all EOP and ATP protection rules. You wouldn’t want EOP or ATP blocking your attempt to phish your users, right? Perhaps in the future Microsoft could add a toggle that allows the simulated phishing campaign to be filtered by EOP/ATP to verify that those technologies are able to successfully block the phishing campaign.

How does this compare to other Phishing Simulators?

Other phishing simulators such as KnowBe4 or PhishMe have been around a lot longer, obviously, but Attack Simulator is great for customers who maybe already own the E5 license and want to phish their users at no added cost. If you only have E3 then you could purchase “Threat Intelligence” as an add-on license on top of E3 in order to get the Attack Simulator feature. However, there is another recently added feature included in the Advanced Threat Protection (ATP) license called ATP Anti-Phishing Policies which you would also get in the E5 license and therefore I feel the best value is to get the E5 rather than trying to purchase separate add-ons. I wrote a little bit about the new Anti-Phishing solution in my recent post where I wrote about the top 15 things to do before and after a phishing attack in Office 365. Basically, the new Anti-Phishing Policy can send items to quarantine if any part of the email address has been modified to bypass DMARC. For example, while DMARC protects the exact spelling of an impersonated CEO, it does not protect against a slight variation of a CEO’s address. Like Joe.Ceo@Contoso.com spelled with a zero instead of an alphabetic O, like Joe.Ceo@C0ntoso.com. In those cases, the new Anti-phishing policy can be configured to send those emails to quarantine, or redirect them to a security team, or other actions.

Need help?

Patriot Consulting provides assistance with deploying Microsoft Security solutions. We start with a free consultation to help you understand your current Microsoft licensing level, and we help you deploy the security solutions that you may already own inside your Microsoft licenses. Then we can help you pilot additional security solutions from Microsoft.

Why Patriot?

We are a Microsoft Gold Enterprise Mobility + Security Partner and have helped hundreds of companies deploy Microsoft security solutions. We focus 100% exclusively on Microsoft Cloud technologies and believe in “do one thing and do it well.” We participate in the Microsoft Partner Seller Program, and we are a Managed Microsoft Partner, which gives us access to the latest training and roadmap. As a member of the Microsoft Security Council, we have direct access to the Microsoft Product Group that develops the software.

References: