Systems and methods for performing simulated phishing attacks using social engineering indicators

Patent metadata

Field	Value
Publication number	US-11070587-B2
Application number	US-202016750640-A
Country	US
Kind code	B2
Filing date	Jan 23, 2020
Priority date	Jan 5, 2017
Publication date	Jul 20, 2021
Grant date	Jul 20, 2021

Abstract

Systems and methods are provided for performing simulated phishing attacks using social engineering indicators. One or more failure indicators can be configured in a phishing email template, and each failure indicator can be assigned a description about that failure indicator through use of a markup tag. The phishing email template containing the markup tags corresponding to the failure indicators can be stored and can be used to generate a simulated phishing email in which the one or more markup tags are removed.

First claim

What is claimed is:

1. A method comprising:
communicating, by a server, a simulated phishing email to one or more email accounts, the simulated phishing email comprising a link to a page embedding a copy of the simulated phishing email using a phishing email template, the phishing email template comprising one or more failure indicators, each of the one or more failure indicators assigned a flag and a description on identifying that type of failure indicator;
causing to display the page embedding the copy of the simulated phishing email responsive to an interaction with the link by a user of an email account of the one or more email accounts receiving the simulated phishing email;
causing to display with the copy of the simulated phishing email one or more flags from the phishing email template corresponding to the one or more failure indicators; and
causing to display a flag of the one or more flags in the copy of the simulated phishing email, the copy of the simulated phishing emails configured to provide the description on how to identify that type of failure indicator corresponding to the flag.

2. The method of claim 1 , further comprising causing the description to display in one of an overlay or popup box responsive to an interaction with the flag.

3. The method of claim 2 , wherein the interaction comprises a pointer hovering over the flag.

4. The method of claim 1 , wherein the flag comprises an icon.

5. The method of claim 1 , wherein the user interaction with the link comprises a selection of the link to traverse to the display of the copy of the simulated phishing email.

6. The method of claim 1 , further comprising tracking, by the server, the one or more failure indicators associated with the interaction with the simulated phishing email by the user.

7. The method of claim 1 , further comprising tracking, by the server, which user interacted with the simulated phishing email.

8. A system comprising:
a non-transitory memory;
one or more processors, coupled to the non-transitory memory and configured to:
communicate a simulated phishing email to one or more email accounts, the simulated phishing email comprising a link to a page embedding a copy of the simulated phishing email using a phishing email template, the phishing email template comprising one or more failure indicators, each of the one or more failure indicators assigned a flag and a description on identifying that type of failure indicator;
wherein the one or more processors:
cause to display the page embedding the copy of the simulated phishing email responsive to an interaction with the link by a user of an email account of the one or more email accounts receiving the simulated phishing email;
cause to display with the copy of the simulated phishing email one or more flags from the phishing email template corresponding to the one or more failure indicators; and
cause to display a flag of the one or more flags in the copy of the simulated phishing email, the copy of the simulated phishing emails configured to provide the description on how to how to identify that type of failure indicator corresponding to the flag.

9. The system of claim 8 , wherein the one or more processors are further configured to cause the description to display in one of an overlay or popup box responsive to an interaction with the flag.

10. The system of claim 8 , wherein the interaction comprises a pointer hovering over the flag.

11. The system of claim 8 , wherein the flag comprises an icon.

12. The system of claim 8 , wherein the user interaction with the link comprises a selection of the link to traverse to the display of the copy of the simulated phishing email.

13. The system of claim 8 , wherein the one or more processors are further configured to track the one or more failure indicators associated with the interaction with the simulated phishing email by the user.

14. The system of claim 8 , wherein the one or more processors are further configured to track which user interacted with the simulated phishing email.

15. A non-transitory computer readable medium storing program instructions for causing one or more processors to:
communicate a simulated phishing email to one or more email accounts, the simulated phishing email comprising a link to a page embedding a copy of the simulated phishing email using a phishing email template, the phishing email template comprising one or more failure indicators, each of the one or more failure indicators assigned a flag and a description on identifying that type of failure indicator;
wherein the program instructions cause the one or more processors to:
cause to display the page embedding the copy of the simulated phishing email responsive to an interaction with the link by a user of an email account of the one or more email accounts receiving the simulated phishing email;
cause to display with the copy of the simulated phishing email one or more flags from the phishing email template corresponding to the one or more failure indicators; and
cause to display a flag of the one or more flags in the copy of the simulated phishing email, the copy of the simulated phishing emails configured to provide the description on how to identify that type of failure indicator corresponding to the flag.

16. The non-transitory computer readable medium of claim 15 , wherein the one or more processors are further configured to cause the description to display in one of an overlay or popup box responsive to an interaction with the flag.

17. The non-transitory computer readable medium of claim 16 , wherein the interaction comprises a pointer hovering over the flag.

18. The non-transitory computer readable medium of claim 15 , wherein the flag comprises an icon.

19. The non-transitory computer readable medium of claim 15 , wherein the user interaction with the link comprises a selection of the link to traverse to the display of the copy of the simulated phishing email.

20. The non-transitory computer readable medium of claim 15 , wherein the program instructions further cause the one or more processors to track which user interacted with the simulated phishing email and the one or more failure indicators associated with the user.

Assignees

• Knowbe4 Inc

Inventors

• Irimie Alin
• Kras Greg
• Austin David
• Dalton Benjamin

Classifications

• H04L51/52

  for supporting social networking services · CPC title

• H04L63/1483 Primary

  service impersonation, e.g. phishing, pharming or web spoofing (detection of rogue wireless access points H04W12/12) · CPC title

• H04L51/18 Primary

  Commands or executable codes · CPC title

• G06F40/186

  Templates · CPC title

• H04L63/1433

  Vulnerability analysis · CPC title