Systems and methods for effective delivery of simulated phishing campaigns

Patent metadata

Field	Value
Publication number	US-11729206-B2
Application number	US-202318094632-A
Country	US
Kind code	B2
Filing date	Jan 9, 2023
Priority date	Aug 24, 2020
Publication date	Aug 15, 2023
Grant date	Aug 15, 2023

Abstract

Systems and methods are described for verifying whether simulated phishing communications are allowed to pass by a security system of an email system to email account of users. One or more email accounts of the email system with the security system may be identified to use for a delivery verification campaign. Further, one or more types of simulated phishing communications may be selected from a plurality of types of simulated phishing communications. The delivery verification campaign may be configured to include the selection of the one or more types of simulated phishing communications from the plurality of types of simulated phishing communications. The selected one or more types of simulated phishing communications of the delivery verification campaign may be communicated to the one or more email accounts. Further, whether or not each of the one or more types of simulated phishing communications was allowed by the security system to be received unchanged at the one or more email accounts.

First claim

What is claimed is:

1. A method comprising:
identifying, by one or more processors, a mailbox of a user of an email system for which to target one or more simulated phishing communications;
identifying, by the one or more processors, a simulated phishing communication of the one or more simulated phishing communications to communicate to the user; and
causing, by the one or more processors, a direct injection of an email corresponding to the simulated phishing communication into the mailbox of the user with a timestamp earlier than a time the email was directly injected and one or more timestamps of one or more other emails in the mailbox.

2. The method of claim 1 , wherein causing the direct injection of the email further comprises injecting, by the one or more processors, the email as a new email in the mailbox of the user via one or more application programming interface (API) calls to the email system.

3. The method of claim 2 , further comprising creating, by the one or more processors, the new email based at least on an existing email selected from the mailbox of the user.

4. The method of claim 1 , wherein causing the direct injection of the email further comprises modifying, by the one or more processors, an existing email in the mailbox of the user to provide the simulated phishing communication.

5. The method of claim 4 , further comprising selecting, by the one or more processors, the existing email from a folder in the mailbox of the user.

6. The method of claim 1 , wherein the email corresponding to the simulated phishing communication is addressed to one or more recipients in an organization of the user.

7. The method of claim 1 , further comprising changing, by the one or more processors, a status of the email corresponding to the simulated phishing communication.

8. The method of claim 7 , wherein the status of the email is changed to appear one of opened, read or unread.

9. The method of claim 1 , further comprising changing, by the one or more processors, an importance of the email corresponding to the simulated phishing communication in the email system.

10. The method of claim 1 , further comprising causing, by the one or more processors, the direct injection of a second email corresponding to the simulated phishing communication into the mailbox of the user, the second email related to the email directly injected into the mailbox of the user.

11. A system comprising:
one or more processors, coupled to memory and configured to:
identify a mailbox of a user of an email system for which to target one or more simulated phishing communications;
identify a simulated phishing communication of the one or more simulated phishing communications to communicate to the user; and
cause a direct injection of an email corresponding to the simulated phishing communication into the mailbox of the user with a timestamp earlier than a time the email was directly injected and one or more timestamps of one or more other emails in the mailbox.

12. The system of claim 11 , wherein the one or more processors are further configured to cause the direct injection of the email by injecting the email as a new email in the mailbox of the user via one or more application programming interface (API) calls to the email system.

13. The system of claim 12 , wherein the one or more processors are further configured to create the new email based at least on an existing email selected from the mailbox of the user.

14. The system of claim 11 , wherein the one or more processors are further configured to cause the direct injection of the email by modifying an existing email in the mailbox of the user to provide the simulated phishing communication.

15. The system of claim 14 , wherein the one or more processors are further configured to select the existing email from a folder in the mailbox of the user.

16. The system of claim 11 , wherein the email corresponding to the simulated phishing communication is addressed to one or more recipients in an organization of the user.

17. The system of claim 11 , wherein the one or more processors are further configured to change a status of the email corresponding to the simulated phishing communication.

18. The system of claim 17 , wherein the status of the email is changed to appear one of opened, read or unread.

19. The system of claim 11 , wherein the one or more processors are further configured to change an importance of the email corresponding to the simulated phishing communication in the email system.

20. The system of claim 11 , wherein the one or more processors are further configured to cause the direct injection of the email by the direct injection of a second email corresponding to the simulated phishing communication into the mailbox of the user, the second email related to the email directly injected into the mailbox of the user.

Assignees

• Knowbe4 Inc

Inventors

• Patton Mark William
• Cormier Daniel
• Kras Greg

Classifications

• H04L63/1433 Primary

  Vulnerability analysis · CPC title

• H04L63/1483

  service impersonation, e.g. phishing, pharming or web spoofing (detection of rogue wireless access points H04W12/12) · CPC title

• H04L67/02

  based on web technology, e.g. hypertext transfer protocol [HTTP] · CPC title