At a previous job, there was a header. I can’t remember it directly, but lets say it was like this:
X-Acme-Security-Test: Authorized simulated phishing exercise conducted by KnowBe4 on behalf of Acme Corp for security awareness training and compliance validation
Apparently KnowBe4 lets customers set their own custom headers. So this was probably set by my company. And not something everyone will see.
But also, they set an X-PHISHTEST header. Maybe its a signed header, so they can cryptographically prove the test was in accordance with the customer’s request (this email was sent by us, but it uses YOUR private key, so clearly you were involved here, and we arent just scamming people, or otherwise allows you to validate it at the firewall/spam filter). This isn’t the header I remember, but apparentlly can also be used to detect them – the explicitly say not to do that, but here we are.
But if you ever get a knowbe4 phishing test, check the email headers. you’ll probably find something to key off of.
Also there’s a “congratulations you’re a good boy” popup when you click the report phishing button in outlook, so I guess those headers is how the plugin determines whether this is a test email.
If your company contracts with phish.me then that URL is actually in the email header metadata.
Just set up a rule for the word phish to a special folder, and then you can use the “report” button on everything in that folder to get the credit.
KnowBe4 includes a bunch of headers in the email, including a disclosure saying they have permission to run the simulated phishing test.
I heard a rumour that KnowBe4 have ties to Scientology.
From what some Googling told me, Kevin Mitnick is a scientologist, as is most of the upper management .
Not really relevant here, just interesting…
Tell me more…
Apparently I’m both right and wrong.
At a previous job, there was a header. I can’t remember it directly, but lets say it was like this:
X-Acme-Security-Test: Authorized simulated phishing exercise conducted by KnowBe4 on behalf of Acme Corp for security awareness training and compliance validationApparently KnowBe4 lets customers set their own custom headers. So this was probably set by my company. And not something everyone will see.
But also, they set an
X-PHISHTESTheader. Maybe its a signed header, so they can cryptographically prove the test was in accordance with the customer’s request (this email was sent by us, but it uses YOUR private key, so clearly you were involved here, and we arent just scamming people, or otherwise allows you to validate it at the firewall/spam filter). This isn’t the header I remember, but apparentlly can also be used to detect them – the explicitly say not to do that, but here we are.But if you ever get a knowbe4 phishing test, check the email headers. you’ll probably find something to key off of.
Also there’s a “congratulations you’re a good boy” popup when you click the report phishing button in outlook, so I guess those headers is how the plugin determines whether this is a test email.
So what do you do when you get an actual phishing mail that doesn’t use that word?