Microsoft 365 Defender Security Center Attack Simulation Payload Automation Walkthrough

Question

I am trying to use the Security Center's Attack Simulation Training tab. I have created campaigns and created training. I want to do some payload automation. Please correct me if I am not correct, but Payload automations take phishes in the wild that are reported and makes a template that you can use in your own campaigns right? If that is the case, how do I create an automation and what are the conditions required for it to work? I can't find any walkthroughs on the Payload Automation tab, so if you know of one please point me to it.

If I am not correct, please tell me what Payload Automation does and how I can properly use it.

Thanks!

Answer 1

@anonbumqams Thanks for reaching out. For custom payload, at present we only support Email methods.

Important things to consider while designing a custom payload is that Certain trademarks, logos, symbols, insignias and other source identifiers receive heighted protection under local, state and federal statutes and laws. Unauthorized use of such indicators can subject the users to penalties, including criminal fines.

Though not an extensive list, this includes the Presidential, Vice Presidential, and Congressional seals, the CIA, the FBI, Social Security, Medicare and Medicaid, the United States Internal Revenue Service, and the Olympics. Beyond these categories of trademarks, use and modification of any third-party trademark carries an inherent amount of risk.

Using your own trademarks and logos in a payload would be less risky, particularly where your organization permits the use. If you have any further questions about what is or is not appropriate to use when creating or configuring a payload, you should consult with your legal advisors.

Check more about custom payloads at : https://learn.microsoft.com/en-us/microsoft-365/security/office-365-security/attack-simulation-training-payloads?view=o365-worldwide

Please "Accept the answer" if the information helped you. This will help us and others in the community as well.

Answer 2

IS this more of a question on the Payload Automation aka payload harvesting as detailed in https://learn.microsoft.com/th-th/microsoft-365/security/office-365-security/attack-simulation-training-payload-automations?view=o365-worldwide