Systems and methods for performing or creating simulated phishing attacks and phishing attack campaigns

Patent metadata

Field	Value
Publication number	US-9894092-B2
Application number	US-201715442215-A
Country	US
Kind code	B2
Filing date	Feb 24, 2017
Priority date	Feb 26, 2016
Publication date	Feb 13, 2018
Grant date	Feb 13, 2018

Abstract

A method for establishing a campaign for a simulated phishing attack includes receiving, via a campaign manager, specification of a plurality of parameters for a campaign including at least an identifier of a campaign and identification of users to which to send the campaign, establishing, via the campaign manager, a type of exploit for the campaign and one or more types of data to collect via the type of exploit, storing, by the campaign manager, the campaign comprising the plurality of parameters, and identifying, by a simulation server, the campaign stored in the database to create a simulated phishing email, to be sent to email accounts of the users, using the plurality of parameters of the campaign, wherein the simulated phishing email is to be created to have a link to a landing page comprising the type of exploit and configured to collect the one or more types of data.

First claim

What is claimed is:

1. A method for establishing a campaign for a simulated phishing attack based on at least a type of exploit, the method comprising:
(a) receiving, via a campaign manager executing on a processor coupled to memory, specification of a plurality of parameters for a campaign of a simulated phishing attack, the plurality of parameters including at least an identifier of a campaign and identification of users to which to send the campaign;
(b) establishing, via the campaign manager as parameters of the plurality of parameters, a type of exploit for the campaign and a selection of one or more types of data from a plurality of types of data selectable via an interface of the campaign manager to collect via configuration of the type of exploit;
(c) storing, by the campaign manager to a database, the campaign comprising the plurality of parameters; and
(d) identifying, by a simulation server, the campaign stored in the database to create a simulated phishing email, to be sent to email accounts of the users, using the plurality of parameters of the campaign, wherein the simulated phishing email is to be created to have a link to a landing page comprising the type of exploit and the type of exploit configured to collect the selection of the one or more types of data.

2. The method of claim 1 , wherein (a) further comprises receiving, via the campaign manager, specification of the plurality of parameters identifying one of a start time, a duration or a frequency of the campaign.

3. The method of claim 1 , wherein (a) further comprises receiving, via the campaign manage for the plurality of parameters, a selection of a simulated phishing email template to be used for creating the simulated phishing email.

4. The method of claim 1 , wherein (a) further comprises receiving, via the campaign manager for the plurality of parameters, a selection of a group of users for the identification of users.

5. The method of claim 1 , wherein (b) further comprises receiving, via the campaign manager, a selection of the type of exploit from a plurality of different types of exploits.

6. The method of claim 1 , wherein (b) further comprises receiving, via the campaign manager, the selection of the one or more types of data to collect from one or more of the following types of data: user information, network information, system information and Light Directory Access Protocol (LDAP).

7. The method of claim 1 , further comprising receiving, via the campaign manager for the plurality of parameters, identification of a user group to which to add those users that interact with the simulated phishing email to cause traversal via the link to the landing page.

8. A system for establishing a campaign for a simulated phishing attack based on at least a type of exploit, the system comprising:
a campaign manager executable on a processor coupled to memory, configured to: receive a specification of a plurality of parameters for a campaign of a simulated phishing attack, the plurality of parameters including at least an identifier of a campaign and identification of users to which to send the campaign;
establish, as parameters of the plurality of parameters, a type of exploit for the campaign and a selection of one or more types of data from a plurality of types of data selectable via an interface of the campaign manager to collect via configuration of the type of exploit;
store to a database, the campaign comprising the plurality of parameters; and
a simulation server configured to identify the campaign stored in the database to create a simulated phishing email, to be sent to email accounts of the users, using the plurality of parameters of the campaign, wherein the simulated phishing email is to be created to have a link to a landing page comprising the type of exploit and the type of exploit configured to collect the selection of the one or more types of data.

9. The system of claim 8 , wherein the campaign manager is further configured to receive the specification of the plurality of parameters identifying one of a start time, a duration or a frequency of the campaign.

10. The system of claim 8 , wherein the campaign manager is further configured to receive the for the plurality of parameters, a selection of a simulated phishing email template to be used for creating the simulated phishing email.

11. The system of claim 8 , wherein the campaign manager is further configured to receive a selection of a group of users for the identification of users.

12. The system of claim 8 , wherein the campaign manager is further configured to receive a selection of the type of exploit from a plurality of different types of exploits.

13. The system of claim 8 , wherein the campaign manager is further configured to receive the selection of the one or more types of data to collect from one or more of the following types of data: user information, network information, system information and Light Directory Access Protocol (LDAP).

14. The system of claim 8 , wherein the campaign manager is further configured to receive the identification of a user group to which to add those users that interact with the simulated phishing email to cause traversal via the link to the landing page.

15. A method for running a campaign for a simulated phishing attack based on at least a type of exploit, the method comprising:
(a) establishing, by a campaign manager executing on a processor coupled to memory, a campaign for a simulated phishing attack, the campaign including a plurality of parameters comprising at least an identifier of a campaign, identification of users to which to send the campaign, a type of exploit and a selection of one or more types of data from a plurality of types of data selectable via an interface of the campaign manager to collect via configuration of the type of exploit;
(b) creating, by a simulation server responsive to the campaign, a simulated phishing email using the plurality of parameters of the campaign, wherein the simulated phishing email is created with a link to a landing page comprising the type of exploit and the type of exploit configured to collect the selection of the one or more types of data;
(c) communicating, by the simulation server, the simulated phishing email to email accounts of the identified users; and
(d) receiving, by the simulation server responsive to the user interacting with the simulated phishing email to cause traversal via the link to the landing page, identification of the type of exploit and the one or more types of data collected via the landing page.

16. The method of claim 15 , wherein (a) further comprises establishing, by the campaign manager for the plurality of parameters, one of a start time, a duration or a frequency of the campaign.

17. The method of claim 16 , wherein (c) further comprises communicating, by the simulation server, the simulating phishing email in accordance with one of a start time, a duration or a frequency of the campaign.

18. The method of claim 15 , further comprises establishing, by the campaign manager for the plurality of parameters, a selected group of users for the identification of users.

19. The method of claim 16 , wherein (c) further comprises communicating, by the simulation server, the simulating phishing email to the selected group of users.

20. The method of claim 15 , wherein the plurality of types of data to collect comprise one or more of the following types of data: user information, network information, system information and Light Directory Access Protocol (LDAP).

Assignees

• Knowbe4 Inc

Inventors

• Irimie Alin
• Bartlett Wendy
• Austin David

Classifications

• H04L63/20

  for managing network security; network security policies in general (filtering policies H04L63/0227) · CPC title

• H04L63/1433 Primary

  Vulnerability analysis · CPC title

• H04L63/1483

  service impersonation, e.g. phishing, pharming or web spoofing (detection of rogue wireless access points H04W12/12) · CPC title