Forum Discussion
Anti-phishing: protect against company domain name usage in From DisplayName
- The Microsoft Anti-Phishing system should be smart enough to detect and protect such emails. Ask end users to mark such email as phishing or junk.
I advise you to send the email for analyze, take a look at:
https://docs.microsoft.com/en-us/microsoft-365/security/office-365-security/admin-submission
burningice Post is quite old. But I thought I'd add my rough solution in case it helps anyone. I setup a transport rule to:
If message header "Authentication-Results" matches "smtp.mailfrom=amazonses.com" "dmarc=bestguesspass" then prepend email with disclaimer to to tell recipient user to to be careful, email may be phishing. +And generate incident report to myself so I can learn more how rule is being applied.
I'll see how rule works out before I make any further actions. I noticed all the docu-sign phishing emails I had always were sent using some random amazon server when you look at email header results. The email envelope sender domain and subject line always changes. Everything in the email is nothing but a linked picture, so it's not like I can make a rule to check if a email is really from docu-sign. The subject lines are always nonsensical and usually but not always include some variation of our company name. This is a tough one. I wish we would have some OCR capability in transport rules. There will undoubtedly be legitimate services that are using amazon email servers that I will soon find out about.
If anybody else has a better solution please let me know. Reporting the emails with office365 admin hunting or explorer or in desktop outlook has not had the best success for me. These phishing email keep finding a way to users mailboxes somehow. If 10 of these docusign emails gets stopped, at least 4 of them pass through.