At a previous job, there was a header. I can’t remember it directly, but lets say it was like this:
X-Acme-Security-Test: Authorized simulated phishing exercise conducted by KnowBe4 on behalf of Acme Corp for security awareness training and compliance validation
Apparently KnowBe4 lets customers set their own custom headers. So this was probably set by my company. And not something everyone will see.
But also, they set an X-PHISHTEST header. Maybe its a signed header, so they can cryptographically prove the test was in accordance with the customer’s request (this email was sent by us, but it uses YOUR private key, so clearly you were involved here, and we arent just scamming people, or otherwise allows you to validate it at the firewall/spam filter). This isn’t the header I remember, but apparentlly can also be used to detect them – the explicitly say not to do that, but here we are.
But if you ever get a knowbe4 phishing test, check the email headers. you’ll probably find something to key off of.
Also there’s a “congratulations you’re a good boy” popup when you click the report phishing button in outlook, so I guess those headers is how the plugin determines whether this is a test email.
In the gmail web client, I dont see an option to filter off headers. thunderbird lets you set up filters for custom headers, but it’s a bit more complicated.
TBH, i never used it to set up a custom filter, I just knew there were indicators I could use to figure out if an email was in fact a test
My work computer is quite locked down (can’t even install Solitaire or Minesweeper), so I’ll have to set up whatever filter in Outlook. And I think it deletes the messages once flagged as phishing, so I don’t think I have one to inspect right now.
Anyway, some random blog seems to point back to
KnowBe4’s whitelisting guide, so I think the filter would need to look for something in the header or for the specified IP addresses?
KnowBe4 includes a bunch of headers in the email, including a disclosure saying they have permission to run the simulated phishing test.
I heard a rumour that KnowBe4 have ties to Scientology.
From what some Googling told me, Kevin Mitnick is a scientologist, as is most of the upper management .
Not really relevant here, just interesting…
Tell me more…
Apparently I’m both right and wrong.
At a previous job, there was a header. I can’t remember it directly, but lets say it was like this:
X-Acme-Security-Test: Authorized simulated phishing exercise conducted by KnowBe4 on behalf of Acme Corp for security awareness training and compliance validationApparently KnowBe4 lets customers set their own custom headers. So this was probably set by my company. And not something everyone will see.
But also, they set an
X-PHISHTESTheader. Maybe its a signed header, so they can cryptographically prove the test was in accordance with the customer’s request (this email was sent by us, but it uses YOUR private key, so clearly you were involved here, and we arent just scamming people, or otherwise allows you to validate it at the firewall/spam filter). This isn’t the header I remember, but apparentlly can also be used to detect them – the explicitly say not to do that, but here we are.But if you ever get a knowbe4 phishing test, check the email headers. you’ll probably find something to key off of.
Also there’s a “congratulations you’re a good boy” popup when you click the report phishing button in outlook, so I guess those headers is how the plugin determines whether this is a test email.
Where might I find more details to set up filters?
In the gmail web client, I dont see an option to filter off headers. thunderbird lets you set up filters for custom headers, but it’s a bit more complicated.
TBH, i never used it to set up a custom filter, I just knew there were indicators I could use to figure out if an email was in fact a test
My work computer is quite locked down (can’t even install Solitaire or Minesweeper), so I’ll have to set up whatever filter in Outlook. And I think it deletes the messages once flagged as phishing, so I don’t think I have one to inspect right now.
Anyway, some random blog seems to point back to KnowBe4’s whitelisting guide, so I think the filter would need to look for something in the header or for the specified IP addresses?