Systems and methods for performing simulated phishing attacks using social engineering indicators

Patent metadata

Field	Value
Publication number	US-11601470-B2
Application number	US-202117379086-A
Country	US
Kind code	B2
Filing date	Jul 19, 2021
Priority date	Jan 5, 2017
Publication date	Mar 7, 2023
Grant date	Mar 7, 2023

Abstract

Systems and methods are provided for performing simulated phishing attacks using social engineering indicators. One or more failure indicators can be configured in a phishing email template, and each failure indicator can be assigned a description about that failure indicator through use of a markup tag. The phishing email template containing the markup tags corresponding to the failure indicators can be stored and can be used to generate a simulated phishing email in which the one or more markup tags are removed.

First claim

What is claimed is:

1. A method comprising:
receiving, by a server, a selection of a difficulty rating for a simulated phishing email, the difficulty rating identifying a level of sophistication for the simulated phishing email, wherein a higher level of sophistication is related to a larger percentage of users interacting with one or more failure indicators of the simulated phishing email;
communicating, by the server, the simulated phishing email to one or more email accounts, the simulated phishing email comprising a link to a page having a copy of the simulated phishing email using a phishing email template, the phishing email template comprising the one or more failure indicators based at least on the difficulty rating for the simulated phishing email, each of the one or more failure indicators assigned a flag; and
causing to display the page having the copy of the simulated phishing email responsive to an interaction with the link by a user of an email account of the one or more email accounts receiving the simulated phishing email, the copy of the simulated phishing email having one or more flags from the phishing email template corresponding to the one or more failure indicators.

2. The method of claim 1 , further comprising causing to display a flag of the one or more flags in the copy of the simulated phishing email.

3. The method of claim 2 , wherein the copy of the simulated phishing email is configured to provide a description on how to identify that type of failure indicator corresponding to the flag.

4. The method of claim 1 , wherein each of the one or more failure indicators is assigned a flag of the one or more flags and a description on identifying that type of failure indicator.

5. The method of claim 1 , wherein the copy of the simulated phishing email is embedded in the page.

6. A system comprising:
one or more processors, coupled to a hardware memory and configured to:
receive a selection of a difficulty rating for a simulated phishing email, the difficulty rating identifying a level of sophistication for the simulated phishing email, wherein a higher level of sophistication is related to a larger percentage of users interacting with one or more failure indicators of the simulated phishing email;
communicate the simulated phishing email to one or more email accounts, the simulated phishing email comprising a link to a page having a copy of the simulated phishing email using a phishing email template, the phishing email template comprising the one or more failure indicators based at least on the difficulty rating difficulty rating for the simulated phishing email, each of the one or more failure indicators assigned a flag; and
cause to display the page having the copy of the simulated phishing email responsive to an interaction with the link by a user of an email account of the one or more email accounts receiving the simulated phishing email, the copy of the simulated phishing email having one or more flags from the phishing email template corresponding to the one or more failure indicators.

7. The system of claim 6 , wherein the one or more processors are further configured to cause a flag of the one or more flags in the copy of the simulated phishing email to be displayed.

8. The system of claim 7 , wherein the copy of the simulated phishing email is configured to provide a description on how to identify that type of failure indicator corresponding to the flag.

9. The system of claim 6 , wherein each of the one or more failure indicators is assigned a flag of the one or more flags and a description on identifying that type of failure indicator.

10. The system of claim 6 , wherein the copy of the simulated phishing email is embedded in the page.

11. A method comprising:
receiving, by a server, a selection of a difficulty rating and a phishing link domain for a simulated phishing email, the phishing link domain to mimic a domain associated with a trusted entity, wherein the difficulty rating identifies a level of sophistication for the simulated phishing email and a higher level of sophistication is related to a larger percentage of users interacting with one or more failure indicators of the simulated phishing email;
communicating, by a server, the simulated phishing email to one or more email accounts, the simulated phishing email comprising a link to the phishing link domain that is redirected to a page having a copy of the simulated phishing email using a phishing email template, the phishing email template comprising the one or more failure indicators; and
causing to display the page having the copy of the simulated phishing email responsive to an interaction with the link to the phishing link domain by a user of an email account of the one or more email accounts receiving the simulated phishing email, the copy of the simulated phishing email having one or more flags from the phishing email template corresponding to the one or more failure indicators.

12. The method of claim 11 , further comprising causing to display a flag of the one or more flags in the copy of the simulated phishing email.

13. The method of claim 12 , wherein the copy of the simulated phishing email is configured to provide a description on how to identify that type of failure indicator corresponding to the flag.

14. The method of claim 11 , wherein each of the one or more failure indicators is assigned a flag of the one or more flags and a description on identifying that type of failure indicator.

15. The method of claim 11 , wherein the copy of the simulated phishing email is embedded in the page.

16. A system comprising:
one or more processors, coupled to a hardware memory and configured to:
receive a selection of a difficulty rating and a phishing link domain for a simulated phishing email, the phishing link domain to mimic a domain associated with a trusted entity, wherein the difficulty rating identifies a level of sophistication for the simulated phishing email and a higher level of sophistication is related to a larger percentage of users interacting with one or more failure indicators of the simulated phishing email;
communicate the simulated phishing email to one or more email accounts, the simulated phishing email comprising a link to the phishing link domain that is redirected to a page having a copy of the simulated phishing email using a phishing email template, the phishing email template comprising the one or more failure indicators; and
cause to display the page having the copy of the simulated phishing email responsive to an interaction with the link to the phishing link domain by a user of an email account of the one or more email accounts receiving the simulated phishing email, the copy of the simulated phishing email having one or more flags from the phishing email template corresponding to the one or more failure indicators.

17. The system of claim 16 , wherein the one or more processors are further configured to cause a flag of the one or more flags in the copy of the simulated phishing email to be displayed.

18. The system of claim 17 , wherein the copy of the simulated phishing email is configured to provide a description on how to identify that type of failure indicator corresponding to the flag.

19. The system of claim 16 , wherein each of the one or more failure indicators is assigned a flag of the one or more flags and a description on identifying that type of failure indicator.

20. The system of claim 16 , wherein the copy of the simulated phishing email is embedded in the page.

Assignees

• Knowbe4 Inc

Inventors

• Irimie Alin
• Kras Greg
• Austin David
• Dalton Benjamin

Classifications

• H04L63/1483 Primary

  service impersonation, e.g. phishing, pharming or web spoofing (detection of rogue wireless access points H04W12/12) · CPC title

• H04L51/18 Primary

  Commands or executable codes · CPC title

• H04L63/1433

  Vulnerability analysis · CPC title

• H04L51/52

  for supporting social networking services · CPC title

• G06F40/186

  Templates · CPC title