Anti-phishing: protect against company domain name usage in From DisplayName

[burningice]

Hello, 

we recently got phishing mails for DocuSign and Office.com which passed our Defender for Office 365 protection. 

They looked something like that: 
FROM: contoso <random@randomdomain.ph>

Subject: Your document has been completed. 

I understand that mailbox intelligence protects against impersonating our domain names (like: Office <office@cont0so.org>) and our internal users (like: John Doe <john.doe@random.org>) however nothing seems to protect against using the domain name as DisplayName like in my example above. 

I was already thinking of creating a mail transport rule in order to block messages from outside of our organisation which contain our company names in the display name. However this can be easily circumvented by using slightly different variants of our company names which I can not all think of. 

Therefore, is there any possibility to utilize Defender for Office 365 / Mailbox Intelligence to prevent the usage of our domain names (or in general any specific terms and their similar words) from being used as Display Names? 

Thanks! 

[#2 · Accepted solution]

The Microsoft Anti-Phishing system should be smart enough to detect and protect such emails. Ask end users to mark such email as phishing or junk.
I advise you to send the email for analyze, take a look at:
https://docs.microsoft.com/en-us/microsoft-365/security/office-365-security/admin-submission

[#3]

Hi there - I can indeed confirm the best way forward here is to perform an admin submission to us so we can look at this. - Thanks in advance!

[#4]

It is relatively easy to construct a mail flow rule to take action (which can be a block, a quarantine or a pre-pended disclaimer acting as a warning) on a From line that contains words approximating your organisation name, but be prepared for a high false positive rate. Before taking any of the actions I have suggested, start with something non-intrusive that merely records the number of hits you would obtain were the rule more active. Exempt until your FP rate is low or you have reached the point where the concept has no remaining validity.

Your anti-phishing training should include variations and obfuscations of your organisation name, in order to inculcate due diligence by your recipients.

As other posters have suggested, keep feeding the kitty with admin and user submissions but do not assume that EOP / MDO is always going to save your organisation's collective posterior. Layer your defences.

[#5]

@burningice  Post is quite old. But I thought I'd add my rough solution in case it helps anyone. I setup a transport rule to:

If message header "Authentication-Results" matches "smtp.mailfrom=amazonses.com" "dmarc=bestguesspass" then prepend email with disclaimer to to tell recipient user to to be careful, email may be phishing. +And generate incident report to myself so I can learn more how rule is being applied.

I'll see how rule works out before I make any further actions. I noticed all the docu-sign phishing emails I had always were sent using some random amazon server when you look at email header results. The email envelope sender domain and subject line always changes. Everything in the email is nothing but a linked picture, so it's not like I can make a rule to check if a email is really from docu-sign. The subject lines are always nonsensical and usually but not always include some variation of our company name. This is a tough one. I wish we would have some OCR capability in transport rules. There will undoubtedly be legitimate services that are using amazon email servers that I will soon find out about.

If anybody else has a better solution please let me know. Reporting the emails with office365 admin hunting or explorer or in desktop outlook has not had the best success for me. These phishing email keep finding a way to users mailboxes somehow. If 10 of these docusign emails gets stopped, at least 4 of them pass through.