Attack Simulation Training - external tag

Question

Attack Simulation Training - external tag

ADM-Griffin2, Jay 151

I am testing the Attack Simulation Training. I noticed on the phishing email I received, that the "External" tag that Outlook assigns was missing. That would be a red flag for many people. Is there a way to make this more realistic and have the External tag?

Aholic Liang-MSFT 13,871 Reputation points Microsoft External Staff

2023-04-14T06:21:27.2566667+00:00

Hi @ ADM-Griffin2, Jay, Where are you referring to the external tag of the mail?

In my tests, receiving regular external mail also did not see any External tag in the mail.

Maybe you can share the screenshot after removing all privacy information like domain name and email addresses. This will allow us to better research this issue.
ADM-Griffin2, Jay 151 Reputation points

2023-04-14T12:40:59.7833333+00:00

The newer version of Outlook (365) automatically tags external messages. However, AST phish emails are not tagged.
ADM-Griffin2, Jay 151 Reputation points

2023-04-14T12:42:22.0433333+00:00

This is the AST phish email (no external tag)

2 answers

Your answer

Aholic Liang-MSFT 13,871 Reputation points Microsoft External Staff

2023-04-14T06:21:27.2566667+00:00

Hi @ ADM-Griffin2, Jay, Where are you referring to the external tag of the mail?

In my tests, receiving regular external mail also did not see any External tag in the mail.

Maybe you can share the screenshot after removing all privacy information like domain name and email addresses. This will allow us to better research this issue.
ADM-Griffin2, Jay 151 Reputation points

2023-04-14T12:40:59.7833333+00:00

The newer version of Outlook (365) automatically tags external messages. However, AST phish emails are not tagged.
ADM-Griffin2, Jay 151 Reputation points

2023-04-14T12:42:22.0433333+00:00

This is the AST phish email (no external tag)

Answer 1

Aholic Liang-MSFT 13,871 Microsoft External Staff

Hi @ ADM-Griffin2, Jay,

You can right-click the message in OWA to open view->view message details to compare whether the message headers are different between two emails.

If the answer is helpful, please click "Accept Answer" and kindly upvote it. If you have extra questions about this answer, please click "Comment".

Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.

ADM-Griffin2, Jay 151 Reputation points

2023-04-20T14:24:59.51+00:00

they will definitely be different -- a true external email has mail flow information in the header. My understand is that AST phish exercises are injected into the mail database and do not come through the mail transport.
ADM-Griffin2, Jay 151 Reputation points

2023-04-20T14:26:04.1066667+00:00

It seems the AST product should add whatever is necessary in the mail header to display External or at least give an option to turn this on. The test is not realistic without the External tag.
Aholic Liang-MSFT 13,871 Reputation points Microsoft External Staff

2023-04-26T05:48:41.88+00:00

Hi @ ADM-Griffin2, Jay, Yes, so are my test results. As a workaround, you can precede such messages with an external prefix through a transport rule.
ADM-Griffin2, Jay 151 Reputation points

2023-04-26T11:57:35.15+00:00

@Aholic Liang-MSFT -- Actually that does not work for AST messages since they do not flow through the mail transport rules. I have this rule in place and it does not impact AST messages. It is my understanding that AST messages are injected into the mail database and do not flow through transport.
AndAuf 26 Reputation points

2023-08-24T07:59:34.8433333+00:00

4 months later, I have exactly the same question/issue. Did you ever get a solution for this?
ADM-Griffin2, Jay 151 Reputation points

2023-08-24T12:33:10.4433333+00:00

Nope. Nearly impossible to get legitimate help from something that will require MS intervention.
Chuanhua SHI (NIEC-HQ) 0 Reputation points

2024-03-12T00:59:09.62+00:00

Noticed this as well, wondering if it's just AST or there's a bigger security concern out there.

Answer 2

Hi @ ADM-Griffin2, Jay,

Many features of our current products are designed and upgraded based on customers’ feedback.

You can post your requirements here：Exchange Server · Community (microsoft.com)

With requirements like this increase, the problem may well be released in the future. Thanks for your understanding and support.

If the answer is helpful, please click "Accept Answer" and kindly upvote it. If you have extra questions about this answer, please click "Comment".

Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.

Share via

Attack Simulation Training - external tag

2 answers

Your answer