{"id":529,"date":"2023-08-12T14:43:43","date_gmt":"2023-08-12T07:43:43","guid":{"rendered":"https:\/\/itadmin.blog\/?p=529"},"modified":"2023-08-12T14:43:43","modified_gmt":"2023-08-12T07:43:43","slug":"gophish-simulation-setup-on-microsoft-365","status":"publish","type":"post","link":"https:\/\/itadmin.blog\/?p=529","title":{"rendered":"GoPhish Simulation setup on Microsoft 365"},"content":{"rendered":"\n

How to setup a phishing simulation using gophish and ensure mail is not flagged in Microsoft 365 as spam or phishing so that users will actually receive the phishing test mails.<\/p>\n\n\n\n

In the environment setup we have Microsoft 365 in hybrid with an on-premise exchange server. The environment has “Defender” setup also that include “safe links” and “safe attachments(only useful on 365 accounts, is ineffective with on-prem exchange accounts).<\/p>\n\n\n\n

Additionallly, we have an Astaro\/Sophos UTM appliance acting as an additional mail gateway to filter messages.<\/p>\n\n\n\n

First we need to add the IP of our gophish mailing server to “Enhanced Filtering Connectors” list so it is recognized as phishing.<\/p>\n\n\n\n

Head to Micrsosoft 365 Admin center > Security > Email & Collaboration > Policies & Rules > Threat Policies > Advanced Delivery > Phishing Simulation<\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n

Click on EDIT (not ADD)<\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n
\"\"<\/figure>\n\n\n\n

Then add all the appropriate info to the domains, IPs & URLs<\/p>\n\n\n\n

Next… Safe Links – adding an “allowed link” <\/p>\n\n\n\n

Reference from MS Site : https:\/\/learn.microsoft.com\/en-us\/microsoft-365\/security\/office-365-security\/tenant-allow-block-list-about?view=o365-worldwide#allow-entries-in-the-tenant-allowblock-list<\/a><\/p>\n\n\n\n

UPDATE : If you want to do this, you need to submit your wildcard link to Microsoft.<\/p>\n\n\n\n

GENERAL RULE :
To avoid browsers from flagging your domain links (not safelinks but chrome or firefox…) then do not send more than 250-300 mails per week<\/span><\/strong>.<\/p>\n","protected":false},"excerpt":{"rendered":"

How to setup a phishing simulation using gophish and ensure mail is not flagged in Microsoft 365 as spam or phishing so that users will actually receive the phishing test mails. In the environment setup we have Microsoft 365 in hybrid with an on-premise exchange server. The environment has “Defender” setup also that include “safe… Read More »GoPhish Simulation setup on Microsoft 365<\/span><\/a><\/p>\n","protected":false},"author":2,"featured_media":0,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"neve_meta_sidebar":"","neve_meta_container":"","neve_meta_enable_content_width":"","neve_meta_content_width":0,"neve_meta_title_alignment":"","neve_meta_author_avatar":"","neve_post_elements_order":"","neve_meta_disable_header":"","neve_meta_disable_footer":"","neve_meta_disable_title":"","_themeisle_gutenberg_block_has_review":false,"_ti_tpc_template_sync":false,"_ti_tpc_template_id":"","footnotes":""},"categories":[1],"tags":[],"class_list":["post-529","post","type-post","status-publish","format-standard","hentry","category-uncategorized"],"_links":{"self":[{"href":"https:\/\/itadmin.blog\/index.php?rest_route=\/wp\/v2\/posts\/529","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/itadmin.blog\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/itadmin.blog\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/itadmin.blog\/index.php?rest_route=\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/itadmin.blog\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=529"}],"version-history":[{"count":2,"href":"https:\/\/itadmin.blog\/index.php?rest_route=\/wp\/v2\/posts\/529\/revisions"}],"predecessor-version":[{"id":535,"href":"https:\/\/itadmin.blog\/index.php?rest_route=\/wp\/v2\/posts\/529\/revisions\/535"}],"wp:attachment":[{"href":"https:\/\/itadmin.blog\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=529"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/itadmin.blog\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=529"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/itadmin.blog\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=529"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}