G DATA Phishing Simulation

Microsoft Exchange Online and Microsoft Defender default setup phishing simulation

To ensure that the emails of a phishing simulation campaign are delivered to users’ mailboxes without interruption, and without Defender protection measures identifying these emails as spam and filtering them out, Microsoft provides a simple way to set up a bypass of these protection mechanisms.

Excluded are complex email routing scenarios in which custom connectors route the email message flow.
Creating a phishing campaign via the Microsoft Defender GUI

1.

Open the page Advanced delivery in the Microsoft Defender portal

Show screenshot
Phishing MS Defender

2.

On the Advanced delivery page, select the Phishing simulation tab and click Add.

Show screenshot
Phishing MS Defender

3.

Enter our domains and IPs here and click Add.

At this point, enter all IPs and domains that must be allowed for the phishing simulation. You can find all details in Awarenessmanager under the Whitelisting tab.
Show screenshot
Phishing MS Defender

4.

Review all details once again and click Close

Show screenshot
Phishing MS Defender

All emails that arrive from one of the specified IPs in combination with one of the sender domains will now be forwarded to the recipient’s mailbox without inspection.

Creating a phishing campaign via Windows PowerShell

1.

Open Exchange Online PowerShell with administrative rights and connect to your Microsoft account.

2.

Create the phishing policy with the following command:

New-PhishSimOverridePolicy -Name PhishSimOverridePolicy
Please do not change the name "PhishSimOverridePolicy". The policy must have this name. If a policy with this name already exists, this step can be skipped.

3.

Create the phishing simulation override rule with the following command:

New-ExoPhishSimOverrideRule -Policy PhishSimOverridePolicy -Domains Domain1,Domain2,...Domain10 -SenderIpRanges IPAddressEntry1,IPAddressEntry2

Replace Domain1,Domain2,…​Domain10 with our domains—each separated by a comma.
Replace IPAddressEntry1,IPAddressEntry2 with our IPs—each separated by a comma.

At this point, enter all IPs and domains that must be allowed for the phishing simulation. You can find all details in Awarenessmanager under the Whitelisting tab.

All emails that arrive from one of the specified IPs in combination with one of the sender domains will now be forwarded to the recipient’s mailbox without inspection.