Systems and methods for performing a simulated phishing attack

Patent metadata

Field	Value
Publication number	US-11552991-B2
Application number	US-202017004855-A
Country	US
Kind code	B2
Filing date	Aug 27, 2020
Priority date	Jun 28, 2016
Publication date	Jan 10, 2023
Grant date	Jan 10, 2023

Abstract

Systems and methods for performing a simulated phishing attack are provided. A simulated attack server can send a simulated attack email including a unique identifier to a target. The simulated attack server can receive a reply email including the unique identifier from the target. The simulated attack server can extract the unique identifier from the reply email. The simulated attack server can determine a match between the unique identifier and an identity of the target. The simulated attack server can record a target failure, responsive to determining the match between the unique identifier and the identity of the target.

First claim

What is claimed is:

1. A method comprising:
including, by one or more processors, an identifier of a user within a simulated phishing communication, the identifier uniquely identifying the user separate from any identifier of an email account of the user;
communicating, by the one or more processors, the simulated phishing communication to a first account of the user, the simulated phishing communication communicated to one or more second accounts different from the first account; and
determining, by the one or more processors using the identifier of the user in a reply to the simulated phishing communication, that the reply was received responsive to the simulated phishing communication being communicated to the first account of the user.

2. The method of claim 1 , further comprising assigning, by the one or more processors, a different identifier to each user of a plurality of users that identifies each user separately from any email account of the user.

3. The method of claim 1 , further comprising embedding, by the one or more processors, the identifier of the user in the simulated phishing communication.

4. The method of claim 1 , wherein the simulated phishing communication comprises an email.

5. The method of claim 1 , further comprising including the identifier in one of a body, a subject line, a field or an attachment of the simulated phishing communication.

6. The method of claim 1 , wherein the one or more second accounts are different accounts of the user.

7. The method of claim 1 , wherein the one or more second accounts are one or more email accounts of another user.

8. The method of claim 1 , further comprising identifying, by the one or more processors, the identifier in a location of the reply in which the identifier was included in the simulated phishing communication.

9. The method of claim 1 , further comprising determining, by the one or more processors based at least on the identifier and a source of the reply, that the simulated phishing communication was interacted with via the one or more second accounts.

10. A system comprising:
one or more processors coupled to memory, and configured to:
include an identifier of a user within a simulated phishing communication, the identifier uniquely identifying the user separate from any identifier of an email account of the user;
communicate the simulated phishing communication to a first account of the user, the simulated phishing communication communicated to one or more second accounts different from the first account; and
determine, using the identifier of the user in a reply to the simulated phishing communication, that the reply was received responsive to the simulated phishing communication being communicated to the first account of the user.

11. The system of claim 10 , wherein the one or more processors are further configured to assign a different identifier to each user of a plurality of users that identifies each user separately from any email account of the user.

12. The system of claim 10 , wherein the one or more processors are further configured to embed the identifier of the user in the simulated phishing communication.

13. The system of claim 10 , wherein the simulated phishing communication comprises an email.

14. The system of claim 10 , wherein the one or more processors are further configured to include the identifier in one of a body, a subject line, a field or an attachment of the simulated phishing communication.

15. The system of claim 10 , wherein the one or more second accounts are different accounts of the user.

16. The system of claim 10 , wherein the one or more second accounts are one or more email accounts of another user.

17. The system of claim 10 , wherein the one or more processors are further configured to identify the identifier in a location of the reply in which the identifier was included in the simulated phishing communication.

18. The system of claim 10 , wherein the one or more processors are further configured to determine based at least on the identifier and a source of the reply that the simulated phishing communication was interacted with via the one or more second accounts.

19. A system comprising:
one or more processors coupled to memory, and configured to:
generate a simulated phishing communication comprising an identifier unique to a user and separate from any identifier of an email account of the user;
communicate the simulated phishing communication to a first account of the user, the simulated phishing communication communicated to one or more second accounts different from the first account; and
determine, using the identifier of the user in a reply to the simulated phishing communication, that the reply was received responsive to the simulated phishing communication being communicated to the first account of the user.

20. The system of claim 1 , wherein the one or more processors are further configured to embed the identifier of the user to be invisible in a body of the simulated phishing communication.

Assignees

• Knowbe4 Inc

Inventors

• Irimie Alin
• Sjouwerman Stu
• Jack Brian

Classifications

• H04L63/1483 Primary

  service impersonation, e.g. phishing, pharming or web spoofing (detection of rogue wireless access points H04W12/12) · CPC title

• H04L63/1433

  Vulnerability analysis · CPC title

• H04L51/42

  Mailbox-related aspects, e.g. synchronisation of mailboxes · CPC title

• H04L51/23

  Reliability checks, e.g. acknowledgments or fault reporting · CPC title

• H04L51/18

  Commands or executable codes · CPC title