Spoofing Improvement - From Header

Ken Stewart

2022. augusztus 2. 14:33

I'd like to track replies in a spoofing campaign, but KB4 always sets the From: field to the Reply-To: domain. This results in users seeing the the arcane Reply-To: address (e.g., IT.kssrq22@summittech.employeeportal.net-login.com) in their email client, rather than our company domain (e.g., IT@summittech.us). This is an immediate tip-off that this is a suspicious email. Even when I hard-code From: with our company domain in a customized email template, KB4 overwrites this with [[domain]]. I worked with a support rep for several days trying different configurations before getting a response from engineering that there's no current solution. KB4 should honor their template rules and allow the From: field to be set independently. There are no email protocols that prevent distinct From: and Reply-To: addresses.

0

• 

  Kelsey Leonard 2022. augusztus 3. 18:03

  Hello Ken,

  Thank you for posting! I saw that the Core Support Tech you were working with was able to get the Feature Request submitted regarding the email not looking the same via Send me a test email as it does in a full-campaign utilizing reply-to phishing.

  However, regarding the reply-to address showing in the From portion of the email and not just the reply-to portion is something I'd like to explore further. I'll be creating a follow-up ticket to your previous one and you should be seeing an email shortly.

  Kindest Regards,

  Kelsey Leonard

  KnowBe4

  0

  Hozzászólás-műveletek Permalink
• 

  Ken Stewart 2022. augusztus 3. 19:24

  Hey, Kelsey --

  I didn't see the request Tanisha submitted, but I wanted to describe everything here in case anyone could offer helpful suggestions. The two items you mentioned are distinct in some respects, but both are interrelated. I saw the new ticket, and I'll be happy to discuss this with you more.

  Thanks,

  -Ken

  0

  Hozzászólás-műveletek Permalink
• 

  Kelsey Leonard 2022. augusztus 4. 12:39

  Hello Ken,

  Absolutely! It's always great to post here for additional comments and shared interest amongst others. The feature requests are created internally which is why you might not have seen anything on your end after the original Core Support Tech submitted it. My apologies for any confusion on that!

  The current Core Support Tech with your new ticket will be the main contact and I left them notes to assist. I'll make sure to check in on it to see if there's anything further we can do to help regarding this and to catch up on your notes as well.

  Cheers,

  Kelsey Leonard

  KnowBe4

  0

  Hozzászólás-műveletek Permalink

Hozzászólások írásához jelentkezzen be.