Systems and methods for reporting based simulated phishing campaign
View Patent ↗Systems and methods are described for leveraging the knowledge and security awareness of well-informed users in an organization to protect other users and train them to identify new phishing attacks. Initially, a report of a message being suspicious may be identified and it may be determined whether message is a malicious phishing message. In an example, a well-informed user of an organization may report the message as suspicious. Further, on determining the message to be a malicious phishing message, a simulated phishing message or a template may be created. The simulated phishing message may then be communicated to one or more devices of one or more users.
1. A method comprising:
identifying, by one or more processors, that a message reported as being suspicious is a malicious phishing message;
modifying, by the one or more processors, one or more malicious elements of the malicious phishing message to include one or more links to training content when interacted with by a user;
using, by the one or more processors, the modified malicious phishing message as a simulated phishing message to replace the malicious phishing message in one or more message applications; and
communicating, by the one or more processors, the modified malicious phishing message as the simulated phishing message to one or more message applications.
2. The method of claim 1 , further comprising receiving, by the one or more processors, a report of the message as being suspicious from one or more users during a phishing attack.
3. The method of claim 1 , further comprising modifying, by the one or more processors, the malicious phishing message by removing a malicious element of the one or more malicious elements from the malicious phishing message.
4. The method of claim 1 , further comprising causing, by the one or more processors, the message reported as being suspicious to be replaced in a messaging application of the one or more messaging applications with the modified malicious phishing message.
5. The method of claim 1 , further comprising detecting, by the one or more processors using one or more detection rules, that the reported message is malicious.
6. The method of claim 1 , further comprising creating, by the one or more processors, a second simulated phishing message based at least on the modified malicious phishing message.
7. The method of claim 1 , further comprising creating, by the one or more processors, a template based at least on the modified malicious phishing message.
8. The method of claim 1 , further comprising modifying, by the one or more processors, a link of the one or more malicious elements with a benign link.
9. The method of claim 1 , further comprising modifying, by the one or more processors, a malicious element of the one or more malicious elements by removing one of an attachment or macro of the malicious phishing message.
10. A system comprising:
one or more processors, coupled to memory and configured to:
identify that a message reported as being suspicious is a malicious phishing message;
modify one or more malicious elements of the malicious phishing message to include one or more links to training content when interacted with by a user; and
use the modified malicious phishing message as a simulated phishing message to replace the malicious phishing message in one or more message applications; and
communicate the modified malicious phishing message as the simulated phishing message to one or more message applications.
11. The system of claim 10 , wherein the one or more processors are further configured to receive a report of the message as being suspicious from one or more users during a phishing attack.
12. The system of claim 10 , wherein the one or more processors are further configured to modify the malicious phishing message by removing a malicious element of the one or more malicious elements from the malicious phishing message.
13. The system of claim 10 , wherein the one or more processors are further configured to cause the message reported as being suspicious to be replaced in a messaging application of the one or more messaging applications with the modified malicious phishing message.
14. The system of claim 10 , wherein the one or more processors are further configured to detect, using one or more detection rules, that the reported message is malicious.
15. The system of claim 10 , wherein the one or more processors are further configured to create a second simulated phishing message based at least on the modified malicious phishing message.
16. The system of claim 10 , wherein the one or more processors are further configured to create a template based at least on the modified malicious phishing message.
17. The system of claim 10 , wherein the one or more processors are further configured to modify a link of the one or more malicious elements with a benign link.
18. The system of claim 10 , wherein the one or more processors are further configured to modify a malicious element of the one or more malicious elements by removing one of an attachment or macro of the malicious phishing message.