User Profile
bryan-butler
Copper Contributor
Joined 5 years ago
User Widgets
Recent Discussions
Is it possible that a malicious script created a rule in shared inbox?
Hey everyone, We've been dealing with phishing attempts, including some socially engineered, targeted ones. One of our shared inboxes had a rule created that had the URL of a legitimate organization marked as read and deleted, while we were getting emails from a very similar fake address that was off by one letter. I've asked the team if they created the rule in earnest, and we also have two factor verification set up on all of the accounts, so I'm wondering how this rule got created. Is there a way for someone to create rules when they wouldn't have access to the actual mailbox? Something like a malicious script running when an email got opened? If there is some way, how do you prevent it from happening in the future? I tried searching for something like this, but all of the results would come up about creating a rule to block malicious email, and not malicious email creating rules. Thanks, BryanExchange Rule Flow exception not working
Hi everyone, I'm relatively new to all of this. Recently, we've had an influx of phishing attempts where a random third party email with the display name of a particular co-worker will prompt new hires to send personal info. Warning new employees and prepending warnings into the subject and body hasn't stopped them from responding to the phishing attempts, so I started to route any external email with that display name to myself where I can look at them and forward them on if they are legit. I've created some exceptions where we use a site that will send something on their behalf (such as asking to sign a document, etc), but the exceptions don't get honored, and they still all get routed to me. Does anyone have any idea why the exceptions aren't working? Attached below is a screenshot of the setup. Thanks for any insight you may have! Bryan
