G DATA Phishing Simulation

Microsoft Exchange Online and Microsoft Defender standard setup for a phishing simulation

To ensure that the emails of a phishing simulation campaign are routed unhindered to the users' mailboxes without Defender protection measures recognizing these emails as spam and filtering them out, Microsoft offers the simple option of setting up a bypass for these protection mechanisms.

This does not apply to complex email routing scenarios in which custom connectors route the email message flow.
Creating a phishing campaign via the Microsoft Defender GUI

1.

Open the page advanced delivery in the Microsoft Defender Portal

Show Screenshot
Phishing MS Defender

2.

On the Advanced delivery page, select the Phishing simulation tab and click add.

Show Screenshot
Phishing MS Defender

3.

Now enter our domains and IPs here and click kdb:[add].

Enter all IPs and domains that have to be enabled for the phishing campaign. You will find all details in the Awarenessmanager under the Whitelisting tab.
Show Screenshot
Phishing MS Defender

4.

Check all the details and click close

Show Screenshot
Phishing MS Defender

Now all e-mails arriving from one of the specified IPs in combination with one of the sender domains are forwarded to the recipients mailbox without filtering.

Creating a phishing campaign via the Windows Powershell

1.

Open the Exchange Online Powershell with administrative permissions and connect to your Microsoft account.

2.

Create the phishing policy with the following command:

New-PhishSimOverridePolicy -Name PhishSimOverridePolicy
Please do not change the name "PhishSimOverridePolicy". The policy must be given this name. If there already exists a policy with that name, this step can be skipped.

3.

Create the phishing simulation override rule with the following command:

New-ExoPhishSimOverrideRule -Policy PhishSimOverridePolicy -Domains Domain1,Domain2,...Domain10 -SenderIpRanges IPAddressEntry1,IPAddressEntry2

Replace Domain1,Domain2,…​Domain10 with our domains - each separated by a comma.
Replace IPAddressEntry1,IPAddressEntry2 with our IPs - each separated by a comma.

Enter all IPs and domains that have to be enabled for the phishing campaign. You will find all details in the Awarenessmanager under the Whitelisting tab.

Now all e-mails arriving from one of the specified IPs in combination with one of the sender domains are forwarded to the recipients mailbox without filtering.