Mail Flow - External Message Warning HELP

posternutbag,

Thank you.

Not sure if this will work for us then. We have a couple hundred employees and it seems like more and more of them get spoofed messages from themselves.

Sure!

I listed every employee. For employees with uncommon last names, I just put their last name. For employees with common last names, I listed their full name and maybe some variations if applicable. So e.g.

‘From’ header includes ‘Joseph Smith’ or ‘Joe Smith’ or ‘Joey Smith’ or ‘Badmintonington’ or ‘Jane Doe’

I’m on my phone right now so I don’t remember what the exact syntax was in regards to quotes and whatnot.

posternutbag,

Thank you for the response.

I think most users become complacent no matter what we do to try and protect them and our systems.

We use a thirdparty company to check links and when they are clicked on it's checked against a "safe" list. Most users don't care and even when prompted this might be bad, just click right on through.

In your "From" condition - what do you put in for the header information?

Like "John Smith" or "JSmith",

Is there an example you could share, or a link of how you constructed it?

Thank you,

J.Neal

Hi J. Neal,

For my purposes,

red "prepend" warning = message that shows only when the "from" includes a name from inside our organization but the email is from outside our domain, and

yellow "append" warning = everyone outside our domain

You can refer to the attached images of my rules if that helps.

I think it depends on the threat, and there's not one good answer. Overall, by itself, the "append" is not enough; but if I left it by itself as a "prepend" (solely focused on everyone "external") and every single email preview was preempted by it, the dejected users would eventually grow complacent and ignore the warning anyways. Right now, we seem to be targeted by people who like to put executive-level names in the "from" field, as to trick users who don't pay attention to the actual email address. So between the prepend and the append, I feel like we are somewhat covered, until something changes as it often does.

IMO The major downside of moving the all-encompassing "external" message to the bottom is that it's not up top where the attachments are, so there is not much protection afforded against malicious attachments. It is, however, down underneath the signature, so people will see it right along the "boss's" name, hopefully causing some pause before moving the conversation to text and running out and buying giftcards for some scammer.

As you mentioned-- this is not as obvious when the message is not formatted as HTML, but in my experience the bad ones have all been HTML formatted so far. If they aren't, they are most likely just a few words, and the length of the unformatted warnings that are sandwiching a very small email body hopefully will make them still noticeable enough.

As a third measure, I also have

Set-ExternalInOutlook –Enabled $true

enabled. https://o365reports.com/2021/04/27/enable-external-email-warning-tag-in-exchange-online/

This last measure unfortunately only shows up in web clients or "app" clients such as outlook for iOS-- it is currently not showing up in the latest Outlook 365 for Windows. Once added to outlook desktop proper, it will be a nice flag before a user clicks on an email.