Systems and methods for providing configurable responses to threat identification

Patent metadata

Field	Value
Publication number	US-12019741-B2
Application number	US-202217986856-A
Country	US
Kind code	B2
Filing date	Nov 14, 2022
Priority date	Feb 7, 2020
Publication date	Jun 25, 2024
Grant date	Jun 25, 2024

Abstract

Systems and methods are described for providing customized message content to be displayed to a user of an email client, responsive to the user selecting, via a plug-in or agent of the email client, to report an email as a potential phishing email. In examples, the user may be an employee of an organization and the systems and methods may facilitate a determination by the plug-in or agent of the email client that the reported email is one that does not pose a security risk, such as a simulated phishing email sent by the organization itself, or an email sent from a trusted partner of the organization. The systems and methods may facilitate a customization of the message content that is displayed to the user. In examples, the customized message content may be included or specified within one or more SMTP extension headers of an SMTP email.

First claim

We claim:

1. A method comprising:
identifying, by an agent of an email client of a client device, from one or more Simple Mail Transfer Protocol (SMTP) extension headers of a simulated phishing email a pointer to a storage of content on a remote device, the content to be displayed on the client device responsive to a user identifying via the client device the simulated phishing email as a phishing email;
accessing, by the agent while the email client is online, the content from the storage on the remote device using the pointer from the one or more SMTP extension headers;
storing, by the agent, the content to a location of the client device accessible by the agent when the email client is offline;
receiving, by an agent of the email client while the email client is offline, an indication that the user identified the simulated phishing email as the phishing email; and
causing, responsive to the indication, the client device to display, while the email client is offline, a message using the content from the location of the client device accessible by the agent when the email client is offline.

2. The method of claim 1 , further comprising receiving, by the email client of the client device, the simulated phishing message from a simulated phishing system, the simulated phishing system specifying the pointer to the storage of the content in the one or more SMTP extension headers of the simulated phishing message.

3. The method of claim 1 , further comprising generating, by the agent responsive to the user identifying via the email client the simulated phishing email as the phishing email, the message using the content from the location of the client device accessible by the agent when the email client is offline.

4. The method of claim 3 , further comprising one of personalizing or customizing the message for the user based at least on one or more dynamic fields of the content being populated by the agent.

5. The method of claim 4 , further comprising one of personalizing or customizing the message for the user while the email client is offline.

6. The method of claim 1 , wherein the one or more SMTP extension headers provide one or more instructions to the agent for retrieving the content from the storage of the remote device.

7. The method of claim 1 , wherein the one or more SMTP extension headers provide one or more instructions to the agent for generating the message using the content.

8. The method of claim 1 , wherein the one or more SMTP extension headers comprise a predetermined identifier identifying the simulated phishing email as originating from a simulated phishing system.

9. The method of claim 1 , wherein the one or more SMTP extension headers comprise a predetermined identifier identifying the simulated phishing email as originating from a trusted source.

10. The method of claim 1 , wherein the indication is received responsive to the user reporting that the simulated phishing email is the phishing email via a user interface element displayed via the email client.

11. A system comprising:
an agent of an email client of a client device configured to:
identify, from one or more Simple Mail Transfer Protocol (SMTP) extension headers of a simulated phishing email a pointer to a storage of content on a remote device, the content to be displayed on the client device responsive to a user identifying via the client device the simulated phishing email as a phishing email;
access, while the email client is online, the content from the storage on the remote device using the pointer from the one or more SMTP extension headers;
store the content to a location of the client device accessible by the agent when the email client is offline;
receive, while the email client is offline, an indication that the user identified the simulated phishing email as the phishing email; and
cause, responsive to the indication, the client device to display, while the email client is offline, a message using the content from the location of the client device accessible by the agent when the email client is offline.

12. The system of claim 11 , wherein the email client of the client device receives the simulated phishing message from a simulated phishing system, the simulated phishing system specifying the pointer to the storage of the content in the one or more SMTP extension headers of the simulated phishing message.

13. The system of claim 11 , wherein the agent is further configured to generate, responsive to the user identifying via the email client the simulated phishing email as the phishing email, the message using the content from the location of the client device accessible by the agent when the email client is offline.

14. The system of claim 13 , wherein the agent is further configured to one of personalize or customize the message for the user based at least on one or more dynamic fields of the content being populated by the agent.

15. The system of claim 14 , wherein the agent is further configured to one of personalize or customize the message for the user while the email client is offline.

16. The system of claim 11 , wherein the one or more SMTP extension headers provide one or more instructions to the agent for retrieving the content from the storage of the remote device.

17. The system of claim 11 , wherein the one or more SMTP extension headers provide one or more instructions to the agent for generating the message using the content.

18. The system of claim 11 , wherein the one or more SMTP extension headers comprise a predetermined identifier identifying the simulated phishing email as originating from a simulated phishing system.

19. The system of claim 11 , wherein the one or more SMTP extension headers comprise a predetermined identifier identifying the simulated phishing email as originating from a trusted source.

20. The system of claim 11 , wherein the indication is received responsive to the user reporting that the simulated phishing email is the phishing email via a user interface element displayed via the email client.

Assignees

• Knowbe4 Inc

Inventors

• Kras Greg
• Alessandrini Adam

Classifications

• G09B19/0053

  Computers, e.g. programming · CPC title

• H04L63/1483 Primary

  service impersonation, e.g. phishing, pharming or web spoofing (detection of rogue wireless access points H04W12/12) · CPC title

• H04L51/08

  Annexed information, e.g. attachments · CPC title

• H04L51/212

  using filtering or selective blocking · CPC title

• H04L63/0227

  Filtering policies (mail message filtering H04L51/212) · CPC title