Systems and methods for performing or creating simulated phishing attacks and phishing attack campaigns

Patent metadata

Field	Value
Publication number	US-11777977-B2
Application number	US-202017107309-A
Country	US
Kind code	B2
Filing date	Nov 30, 2020
Priority date	Feb 26, 2016
Publication date	Oct 3, 2023
Grant date	Oct 3, 2023

Abstract

A method for establishing a campaign for a simulated phishing attack includes receiving, via a campaign manager, specification of a plurality of parameters for a campaign including at least an identifier of a campaign and identification of users to which to send the campaign, establishing, via the campaign manager, a type of exploit for the campaign and one or more types of data to collect via the type of exploit, storing, by the campaign manager, the campaign comprising the plurality of parameters, and identifying, by a simulation server, the campaign stored in the database to create a simulated phishing email, to be sent to email accounts of the users, using the plurality of parameters of the campaign, wherein the simulated phishing email is to be created to have a link to a landing page comprising the type of exploit and configured to collect the one or more types of data.

First claim

What is claimed is:

1. A method comprising:
receiving, by one or more processors, via a user interface a selection of a type of exploit from a plurality of types of exploits provided as selectable choices by the user interface;
receiving, by the one or more processors, via the user interface a selection of one or more types of data from selectable choices of types of data provided by the user interface to be collected by the selected type of exploit; and
communicating, by the one or more processors, a simulated phishing communication with a link that is configured to simulate the selected type of exploit and collect the selected one or more types of data.

2. The method of claim 1 , wherein the simulated phishing communication is further configured to cause, responsive to interaction with the link, the selected one or more types of data collected by the selected type of exploit to be communicated to a server.

3. The method claim 1 , wherein the simulated phishing communications causes responsive to interaction with the link, the type of exploit to be identified to a server.

4. The method of claim 1 , further comprising creating, by the one or more processors, the simulated phishing communication with the link that is configured to cause execution of an application configured to simulate the selected type of exploit.

5. The method of claim 4 , wherein the application is configured to retrieve one or more files from a server to at least one of simulate the selected type of exploit or collect the selected one or more types of data.

6. The method of claim 1 , further comprising creating, by the one or more processors, the simulated phishing communication with the link that is configured to cause execution of an application configured to collect the selected one or more types of data.

7. The method of claim 1 , wherein the selected type of exploit is a fast-acting exploit.

8. A method comprising:
providing, by one or more processors, via a user interface identification of a plurality of simulated phishing campaigns configured with a type of exploit and a selection of one or more types of data to be collected by the type of exploit;
receiving, by the one or more processors, via the user interface a selection of a simulated phishing campaign from the plurality of simulated phishing campaigns to execute; and
communicating, by the one or more processors, a first simulated phishing communication of the selected simulated phishing campaign, the first simulated phishing communication created with a first link that causes simulation of a first type of exploit and to cause collection of the selection of a first one or more types of data.

9. The method of claim 8 , further comprising executing, by the one or more processors, the selected simulated phishing campaign responsive to receiving an indication to execute the selected simulated phishing campaign from the user interface.

10. The method of claim 8 , wherein the first simulated phishing communication is further configured to cause, responsive to an interaction with the first link, the first one or more types of data collected by the type of exploit to be communicated to a server.

11. The method of claim 8 , further comprising creating, by the one or more processors, the first simulated phishing communication with the first link that is configured to cause execution of an application configured to collect the first one or more types of data.

12. The method of claim 8 , further comprising communicating, by the one or more processors, a second simulated phishing communication of the selected simulated phishing campaign, the second simulated phishing communication created with a second link that causes simulation of a second type of exploit and to cause collection of a selection of a second one or more types of data.

13. The method of claim 8 , wherein the first link is configured to cause a result of execution of the first type of exploit to be communication to another device.

14. The method of claim 8 , further comprising receiving, by the one or more processors, via the user interface a selection of the first type of exploit from a plurality of types of exploits provided as selectable choices by the user interface.

15. The method of claim 8 , further comprising receiving, by the one or more processors via the user interface a selection of a first one or more types of data from selectable choices of types of data provided by the user interface to collect for the first type of exploit.

16. A system comprising:
one or more processors, coupled to memory, and configured to:
receive via a user interface a selection of a type of exploit from a plurality of types of exploits provided as selectable choices by the user interface;

receive via the user interface a selection of one or more types of data from selectable choices of types of data provided by the user interface to be collected by the selected type of exploit; and
communicate a simulated phishing communication with a link that is configured to simulate the selected type of exploit and collect the selected one or more types of data.

17. The system of claim 16 , wherein the one or more processors are further configured to identify via the user interface identification of a plurality of simulated phishing campaigns configured with a type of exploit and a selection of one or more types of data to collect via for the type of exploit.

18. The system of claim 17 , wherein the one or more processors are further configured to receive, via the user interface a selection of a simulated phishing campaign from the plurality of simulated phishing campaigns to execute and to communicate the simulated phishing communication as part of the selected simulated phishing campaign.

19. The system of claim 16 , wherein the simulated phishing communication is further configured to cause, responsive to interaction with the link, the selected one or more types of data collected by the selected type of exploit to be communicated to a server.

20. The system of claim 16 , wherein the simulated phishing communications causes the type of exploit to be identified to a server responsive to an interaction with the link.

Assignees

• Knowbe4 Inc

Inventors

• Irimie Alin
• Bartlett Wendy
• Austin David

Classifications

• H04L63/1433 Primary

  Vulnerability analysis · CPC title

• H04L63/1483

  service impersonation, e.g. phishing, pharming or web spoofing (detection of rogue wireless access points H04W12/12) · CPC title

• H04L63/20

  for managing network security; network security policies in general (filtering policies H04L63/0227) · CPC title