Can AttackSimulation be provided with an external url?

Question

Hi,

Can Attack Simulation be provided with an external URL in the free text field (the field in the Attack Simulation creation process, where the user can add their custom text )?

What will happen in case any user clicks on this URL? Will they be redirected to the external website?

Thanks,

Adi

Answer 1

You can :

https://techcommunity.microsoft.com/t5/security-compliance-and-identity/the-attack-simulation-training-landing-page-is-now-customizable/ba-p/2777460

but take note:

Note

Check the availability of the simulated phishing URL in your supported web browsers before you use the URL in a phishing campaign. While we work with many URL reputation vendors to always allow these simulation URLs, we don't always have full coverage (for example, Google Safe Browsing). Most vendors provide guidance that allows you to always allow specific URLs (for example, https://support.google.com/chrome/a/answer/7532419).

https://learn.microsoft.com/en-us/microsoft-365/security/office-365-security/attack-simulation-training-get-started?view=o365-worldwide#simulations

Answer 2

Yes, Attack Simulation training allows you to provide a custom URL in the free text field during the creation of a simulation. If a user clicks on this URL, they will be redirected to the external website. However, it is important to note that you should check the availability of the URL in your supported web browsers before using it in a phishing campaign, as some URL reputation vendors may identify it as unsafe. Additionally, some network proxy solutions and filter drivers may block or drop phishing simulation URLs and admin URLs, so it is recommended to configure the required URLs to bypass scanning by your security devices or filters as needed.

---

References:

• Get started using Attack simulation training
• Simulate a phishing attack with Attack simulation training
• Attack simulation training deployment considerations and FAQ