Full Name vs Sender comparison phishing check [message #146625] |
Wed, 18 September 2019 14:44  |
 |
jcooper
Messages: 113 Registered: May 2009 Location: Syracuse, NY
|
|
|
|
Add field/setting to filters so the following rule could be run on the server:
IF senderFriendlyName IS IN Users.FullName AND SenderAddress DOES NOT CONTAIN domain.com, perform action.
Example: email appears to be from me, but is actually from someone faking my name, I can flag it as spam:
==============
From: Jeff Cooper <evilhacker<_at_>gmail.com>
To: End User <enduser<_at_>mydomain.com>
SUBJECT: Important Task
MESSAGE: Please click this link to send gift cards to an important client!
==============
Most end-users do not bother checking the address of the sender, only react (clicking a bad link or something) when they recognize the name.
Thanks,
Jeff
|
|
|
|
Re: Full Name vs Sender comparison phishing check [message #146690 is a reply to message #146625] |
Fri, 27 September 2019 19:49   |
SiriusMac
Messages: 98 Registered: April 2010
|
|
|
|
jcooper wrote on Wed, 18 September 2019 05:44Add field/setting to filters so the following rule could be run on the server:
IF senderFriendlyName IS IN Users.FullName AND SenderAddress DOES NOT CONTAIN domain.com, perform action.
Example: email appears to be from me, but is actually from someone faking my name, I can flag it as spam:
==============
From: Jeff Cooper <evilhacker<_at_>gmail.com>
To: End User <enduser<_at_>mydomain.com>
SUBJECT: Important Task
MESSAGE: Please click this link to send gift cards to an important client!
==============
Most end-users do not bother checking the address of the sender, only react (clicking a bad link or something) when they recognize the name.
Thanks,
Jeff
Yes! We are seeing more and more of this type of attack, made all the more difficult as Outlook seems to be going out of its way to mask the email address from the senderFriendlyName. The challenge as I see it is determining how to differentiate between, using the example presented "From: Jeff Cooper <evilhacker<_at_>gmail.com>" and "From: Jeff Cooper [RealJeffCooper]<_at_>gmail.com>.
|
|
|
|