0

At work our security department frequently sends fake phishing mails to see who is dumb enough to click them.

All these mails originate from the same server (smtp.mailfrom=psm.knowbe4.com). Is there a way to create a filter in Outlook web version / Prospect Mail to automatically filter all of them out?

To clarify, they send emails from all sorts of domains. So for example, the sender address of one of their mails comes from it@<mycompanyname>.com or [email protected]. One time they used an email address from customs, one time from a public library.

The only commonalities between the emails that I found was the server it was sent from (see above) and this header field:

X-PHISHTEST: This is a phishing security test from KnowBe4 that has been authorized by the recipient organization

2 Answers 2

1

Yes, you need to create a "rule".. not a "filter".

  1. Right click on one of these puppies.
  2. Go down to "Advanced actions -> Create rule"
  3. Immediately choose "More options" (now you are in the zone).
  4. Change the title of the rule to something sensible.
  5. In "Add a condition, use the dropdown and select "Sender Address Includes". Guess the rest? ;)
  6. In "Add an action", only you know what do from here.

You might need to play with the options under "Add a condition" to get it just right. This is indeed how it is done.

5
  • The problem is, they send messages from all sorts of domains, for example [email protected]. So I don't have to filter for the domain, but for the server that sends the message.
    – Dakkaron
    Aug 16, 2022 at 17:04
  • When selecting the Message header includes rule, it only lets me input a single field. Is that the header name, or name and content formatted in some special way?
    – Dakkaron
    Aug 16, 2022 at 17:11
  • It should be the raw ASCII text you are looking for. I use this when I get on a mailing list that includes many many servers.. I look for the unique tidbit that they all include (because it is a bot generating them) and include that in my rule to punt them. Aug 16, 2022 at 17:13
  • Ok, so Message header includes doesn't parse the header, but instead just does a "contains" search over the whole header and checks, if that raw string is in there. Thanks, that helped a lot!
    – Dakkaron
    Aug 16, 2022 at 17:15
  • Also, I believe (don't have time to mess with it now) that you can include multiple rules if looking for multiple pieces of text and somehow AND them.. the rich client version of outlook supports this.. so it is probably hidden somewhere in the web client. Aug 16, 2022 at 17:15
1

You can view the message header and get it by opening email message properties.

View internet message headers in Outlook (microsoft.com)

Use EXRCA to analyze the message header.

Microsoft Remote Connectivity Analyzer

Here's a similar thread for your reference. https://statics.teams.cdn.office.net/evergreen-assets/safelinks/1/atp-safelinks.html

1
  • How's everything going now?
    – Aaron
    Aug 22, 2022 at 9:42

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .