Systems and methods for performing simulated phishing attacks using social engineering indicators

Patent metadata

Field	Value
Publication number	US-9749360-B1
Application number	US-201715455448-A
Country	US
Kind code	B1
Filing date	Mar 10, 2017
Priority date	Jan 5, 2017
Publication date	Aug 29, 2017
Grant date	Aug 29, 2017

Abstract

Systems and methods are provided for performing simulated phishing attacks using social engineering indicators. One or more failure indicators can be configured in a phishing email template, and each failure indicator can be assigned a description about that failure indicator through use of a markup tag. The phishing email template containing the markup tags corresponding to the failure indicators can be stored and can be used to generate a simulated phishing email in which the one or more markup tags are removed.

First claim

What is claimed is:

1. A method for running a simulated phishing email attack with a simulated phishing email having one or more failure indicators, the method comprising:
(a) transmitting, by a simulated attack manager, a simulated phishing email to one or more email accounts, the simulated phishing email comprising a link to a copy of the simulated phishing email based on a phishing email template, the phishing email template comprising one or more failure indicators, each of the one or more failure indicators assigned a flag and a description on how to identify that type of failure indicator;
(b) traversing via the link to a display of a copy of the simulated phishing email responsive to a user interaction with the simulated phishing email by a user of an email account of the one or more email accounts receiving the simulated phishing email;
(c) displaying with the copy of the simulated phishing email one or more flags from the phishing email template corresponding to the one or more failure indicators; and
(d) displaying, responsive to a user interaction with a flag of the one or more flags in the copy of the simulated phishing email, the description to how to identify that type of failure indicator corresponding to the flag in one of a pop up box or overlay user interface responsive to a pointer hovering over the flag.

2. The method of claim 1 , wherein (b) further comprises receiving a click on a portion of the simulated phishing email corresponding to a failure indicator.

3. The method of claim 1 , wherein (b) further comprises receiving a click on a uniform resource locator within the simulated phishing email corresponding to a failure indicator.

4. The method of claim 1 , wherein (b) further comprises traversing via the link to a landing page that embeds the copy of the simulated phishing with one or more flags highlighted.

5. The method of claim 1 , wherein (c) further comprises highlighting the flag of the failure indicator that was clicked on in the simulated phishing email.

6. The method of claim 1 , further comprising tracking which users of email accounts clicked on the simulated phishing email.

7. The method of claim 6 , further comprising tracking the one or more failure indicators associated with the users clicking on the simulated phishing email.

8. A system for running a simulated phishing attack with a simulated phishing email having one or more failure indicators, the system comprising:
a simulated attack manager executable on a device comprising a processor coupled to memory, the simulated phishing attack manager configured to transmit a simulated phishing email to one or more email accounts, the simulated phishing email comprising a link to a copy of the simulated phishing email based on a phishing email template, the phishing email template comprising one or more failure indicators, each of the one or more failure indicators assigned a flag and a description on how to identify that type of failure indicator;
wherein the simulated phishing email is configured to traverse via the link to a display of a copy of the simulated phishing email responsive to a user interaction with the simulated phishing email by a user of an email account of the one or more email accounts receiving the simulated phishing email; and
a server configured to display the copy of the simulated phishing email with one or more flags from the phishing email template corresponding to the one or more failure indicators; and responsive to a user interaction with a flag of the one or more flags in the copy of the simulated phishing email display the description on how to identify that type of failure indicator corresponding to the flag in one of a pop up box or overlay user interface responsive to a pointer hovering over the flag.

9. The system of claim 8 , wherein the simulated phishing email is further configured to traverse via the link responsive to a click on a portion of the simulated phishing email corresponding to a failure indicator.

10. The system of claim 8 , wherein the simulated phishing emails is further configured to traverse via the link responsive to a click on a uniform resource locator within the simulated phishing email corresponding to a failure indicator.

11. The system of claim 8 , wherein the link comprises a landing page that embeds the copy of the simulated phishing with one or more flags highlighted.

12. The system of claim 8 , wherein the copy of the simulated phishing email is further configured to highlight the flag of the failure indicator that was clicked on in the simulated phishing email.

13. The system of claim 8 , wherein the copy of the simulated phishing email is further configured to display the description in one of a pop up box or overlay responsive to a pointer hovering over the flag.

14. The system of claim 8 , wherein the simulated phishing attack manager is further configured to track which users of email accounts clicked on the simulated phishing email.

15. The system of claim 14 , wherein the simulated phishing attack manager is further configured to track the one or more failure indicators associated with the users clicking on the simulated phishing email.

Assignees

• Knowbe4 Inc

Inventors

• Irimie Alin
• Kras Greg
• Austin David
• Dalton Benjamin

Classifications

• G06F40/186

  Templates · CPC title

• H04L63/1483 Primary

  service impersonation, e.g. phishing, pharming or web spoofing (detection of rogue wireless access points H04W12/12) · CPC title

• H04L63/1433

  Vulnerability analysis · CPC title

• H04L51/18 Primary

  Commands or executable codes · CPC title

• H04L51/52

  for supporting social networking services · CPC title