Systems and methods for performing a simulated phishing attack

Patent metadata

Field	Value
Publication number	US-10826937-B2
Application number	US-201916409387-A
Country	US
Kind code	B2
Filing date	May 10, 2019
Priority date	Jun 28, 2016
Publication date	Nov 3, 2020
Grant date	Nov 3, 2020

Abstract

Systems and methods for performing a simulated phishing attack are provided. A simulated attack server can send a simulated attack email including a unique identifier to a target. The simulated attack server can receive a reply email including the unique identifier from the target. The simulated attack server can extract the unique identifier from the reply email. The simulated attack server can determine a match between the unique identifier and an identity of the target. The simulated attack server can record a target failure, responsive to determining the match between the unique identifier and the identity of the target.

First claim

What is claimed is:

1. A method comprising:
(a) assigning, by one or more processors coupled to memory, a unique identifier to each user of a plurality of users that identifies a user separately from any email account of the user;
(b) embedding, by the one or more processors, the unique identifier of a user in a simulated phishing email to be communicated to a first email account of the user;
(c) communicating, by the one or more processors, the simulated phishing email to the first email account of the user, the simulated phishing email communicated to one or more second email accounts different from the first email account of the user;
(d) receiving, by the one or more processors, a reply email communicated from at least one of the one or more second email accounts, the reply email comprising the unique identifier; and
(e) determining, by the one or more processors based at least on the unique identifier of the user in the reply email, that the reply email was received responsive to the simulated phishing email communicated to the first email account of the user.

2. The method of claim 1 , wherein the unique identifier identifies the user regardless of which email account is used to reply to the simulated phishing email.

3. The method of claim 1 , wherein (b) further comprises embedding the unique identifier in one of a body, a subject line or an attachment of the simulated phishing email.

4. The method of claim 1 , wherein (b) further comprises embedding the unique identifier in one of a from field or a cc field of the simulated phishing email.

5. The method of claim 1 , wherein (b) further comprises generating the simulated phishing email to include an email address hosted by the one or more processors for which the reply email is communicated when replying to the simulated phishing email.

6. The method of claim 1 , wherein the one or more second email accounts are one or more email accounts of a second user.

7. The method of claim 1 , wherein (d) further comprises receiving, by the one or more processors, the reply email sent to one of a domain of or a domain hosted by the one or more processors.

8. The method of claim 1 , wherein (e) further comprises identifying, by the one or more processors, the unique identifier in a location of the reply email in which the unique identifier is embedded.

9. The method of claim 1 , wherein (e) further comprises determining, by the one or more processors based at least on the unique identifier and a from field of the reply email, that the simulated phishing email was interacted via a second email account different from the first email account of the user to which the simulated phishing email was targeted.

10. A system comprising:
one or more processors coupled to memory, and configured to:
assign a unique identifier to each user of a plurality of users that identifies a user separately from any email account of the user;
embed the unique identifier of a user simulated phishing email to be communicated to a first email account of the user;
communicate the simulated phishing email to the first email account of the user, the simulated phishing email communicated to one or more second email accounts different from the first email account of the user;
receive a reply email communicated from at least one of the one or more second email accounts, the reply email comprising the unique identifier; and
determine, based at least on the unique identifier of the user in the reply email, that the reply email was received responsive to the simulated phishing email communicated to the first email account of the user.

11. The system of claim 10 , wherein the unique identifier identifies the user regardless of which email account is used to reply to the simulated phishing email.

12. The system of claim 10 , wherein the one or more processors are configured to embed the unique identifier in one of a body, a subject line or an attachment of the simulated phishing email.

13. The system of claim 10 , wherein the one or more processors are configured to embed the unique identifier in one of a from field or a cc field of the simulated phishing email.

14. The system of claim 10 , wherein the one or more processors are configured to generate the simulated phishing email to include an email address hosted by the one or more processors for which the reply email is communicated when replying to the simulated phishing email.

15. The system of claim 10 , wherein the one or more second email accounts are one or more email accounts of a second user.

16. The system of claim 10 , wherein the one or more processors are configured to receive the reply email sent to one of a domain of or a domain hosted by the one or more processors.

17. The system of claim 10 , wherein the one or more processors are configured to identify the unique identifier in a location of the reply email in which the unique identifier is embedded.

18. The system of claim 10 , wherein the one or more processors are configured to determine, based at least on the unique identifier and a from field of the reply email, that the simulated phishing email was interacted via a second email account different from the first email account of the user to which the simulated phishing email was targeted.

Assignees

• Knowbe4 Inc

Inventors

• Irimie Alin
• Sjouwerman Stu
• Jack Brian

Classifications

• H04L63/1425

  Traffic logging, e.g. anomaly detection · CPC title

• G06Q10/0639

  Performance analysis of employees; Performance analysis of enterprise or organisation operations · CPC title

• H04L51/23

  Reliability checks, e.g. acknowledgments or fault reporting · CPC title

• H04L51/42

  Mailbox-related aspects, e.g. synchronisation of mailboxes · CPC title

• H04L63/1483 Primary

  service impersonation, e.g. phishing, pharming or web spoofing (detection of rogue wireless access points H04W12/12) · CPC title