Simulate a phishing attack with Attack simulation training

In Attack simulation training in Microsoft 365 E5 or Microsoft Defender for Office 365 Plan 2, simulations are benign cyberattacks that you run in your organization. These simulations test your security policies and practices, as well as train your employees to increase their awareness and decrease their susceptibility to attacks. This article walks you through creating a simulated phishing attack using Attack simulation training.

For getting started information about Attack simulation training, see Get started using Attack simulation training.

To launch a simulated phishing attack, do the following steps:

1. In the Microsoft Defender portal at https://security.microsoft.com, go to Email & collaboration > Attack simulation training > Simulations tab. Or, to go directly to the Simulations tab, use https://security.microsoft.com/attacksimulator?viewid=simulations.

2. On the Simulations tab, select Launch a simulation to start the new simulation wizard.

   

The following sections describe the steps and configuration options to create a simulation.

Select a social engineering technique

On the Select technique page, select an available social engineering technique:

• Credential Harvest^*
• Malware Attachment
• Link in Attachment
• Link to Malware^*
• Drive-by URL
• OAuth Consent Grant^*
• How-to Guide^*

^* This social engineering technique allows you to use QR codes. For more information, see QR code simulations and training.

If you select the View details link in the description, a details flyout opens that describes the technique and the simulation steps that result from the technique.

For more information about the different social engineering techniques, see Simulations.

When you're finished on the Select technique page, select Next.

Name and describe the simulation

On the Name simulation page, configure the following settings:

• Name: Enter a unique, descriptive name for the simulation.
• Description: Enter an optional detailed description for the simulation.

When you're finished on the Name simulation page, select Next.

Select a payload and login page

On the Select payload and login page page, you need to select an existing payload or create a new payload to use.

For the Credential Harvest or Link in Attachment social engineering techniques, you can also view the login page that's used in the payload, select a different login page to use, or create a new login page to use.

Select a payload

The Select payload and login page page has two tabs:

• Global payloads: Contains built-in payloads.
• Tenant payloads: Contains custom payloads.

The following information is shown for each payload:

• Payload name
• Language: The language of the payload content. Microsoft's payload catalog (global) provides payloads in 29+ languages as described in Filter.
• Predicted compromise rate: Historical data across Microsoft 365 that predicts the percentage of people who should be compromised by this payload (users compromised / total number of users who receive the payload). For more information, see Predicted compromise rate.

You can sort the entries by clicking on an available column header.

To find a payload in the list, type part of the payload name in the Search box and then press the ENTER key.

To filter the payloads, select Filter. The following filters are available in the Filters flyout that opens:

• Source: The available values are: Global, Tenant, and All.

• Complexity: Calculated based on the number of indicators in the payload that indicate a possible attack (spelling errors, urgency, etc.). More indicators are easier to identify as an attack and indicate lower complexity. The available values are: High, Medium, and Low.

• Language: The available values are: English, Spanish, German, Japanese, French, Portuguese, Dutch, Italian, Swedish, Chinese (Simplified), Chinese (Traditional, Taiwan), Norwegian Bokmål, Polish, Russian, Finnish, Korean, Turkish, Hungarian, Hebrew, Thai, Arabic, Vietnamese, Slovak, Indonesian, Romanian, Slovenian, Croatian, Catalan, and Other.

• Filter by theme: The available values are: Account Activation, Account Verification, Billing, Clean up Mail, Document Received, Expense, Fax, Finance Report, Incoming Messages, Invoice, Item Received, Login Alert, Mail Received, Password, Payment, Payroll, Personalized Offer, Quarantine, Remote Work, Review Message, Security Update, Service Suspended, Signature Required, Upgrade Mailbox Storage, Verify mailbox, Voicemail, and Other.

• Filter by brand: The available values are: American Express, Capital One, DHL, DocuSign, Dropbox, Facebook, First American, Microsoft, Netflix, Scotiabank, SendGrid, Stewart Title, Tesco, Wells Fargo, Syrinx Cloud, and Other.

• Filter by industry: The available values are: Banking, Business Services, Consumer Services, Education, Energy, Construction, Consulting, Financial Services, Government, Hospitality, Insurance, Legal, Courier Services, Healthcare, Manufacturing, Retail, Telecom, Real Estate, and Other.

• Current event: The available values are Yes or No.

• Controversial: The available values are Yes or No.

When you're finished configuring filters, select Apply, Cancel, or Clear filters.

If you select a payload by selecting the check box next to the name, a Send a test action appears above the list of payloads. Use this action to send a copy of the payload email to yourself (the currently logged in user) for inspection.

On the Tenant payloads tab, if no payloads are available or if you want to create your own payload, select Create a payload. The creation steps are the same as at Attack simulation training > Content library tab > Payloads > Tenant payloads tab. For more information, see Create custom payloads for Attack simulation training.

If you select a payload by clicking anywhere in the row other than the check box next to the name, details about the payload are shown in a flyout that opens:

• The Overview tab (named Payload in Credential Harvest and Link in Attachment payloads) contains details about the payload, including a preview.
• The Login page tab is available only for Credential Harvest or Link in Attachment payloads and is described in the Select a login page subsection.
• The Attachment tab is available only for Malware Attachment, Link in Attachment, and Oauth Consent Grant payloads. This tab contains details about the attachment, including a preview.
• The Simulations launched tab contains the Simulation name, Click rate, Compromised rate, and Action.

If the simulation doesn't use Credential Harvest or Link in Attachment payloads, or if you don't want to view or edit the login page that's used, select Next on the Select payload and login page page to continue.

To select the login page that's used in Credential Harvest or Link in Attachment payloads, go to the Select a login page subsection.

Select a login page

On the Select payload and login page page, select the payload by clicking anywhere in the row other than the check box to open the details flyout for the payload.

In the details flyout of the payload, the Login page tab shows the login page that's currently selected for the payload.

To view the complete login page, use the Page 1 and Page 2 links at the bottom of the page for two-page login pages.

To change the login page that's used in the payload, select Change login page.

On the Select login page flyout that opens, the following information is shown for each login page:

• Name
• Language
• Source: For built-in login pages, the value is Global. For custom login pages, the value is Tenant.
• Created by: For built-in login pages, the value is Microsoft. For custom login pages, the value is the UPN of the user who created the login page.
• Last modified
• Actions: Select Preview to preview the login page.

To find a login page in the list, type part of the login page name in the Search box and then press the ENTER key.

Select Filter to filter the login pages by Source or Language.

To create a new login page, select Create new. The creation steps are the same as at Attack simulation training > Content library tab > Login pages > Tenant login pages tab. For instructions, see Create login pages.

Back on the Select login page, verify the new login page you created is selected, and then select Save.

Back on the payload details flyout, select Close.

When you're finished on the Select a payload and login page page, select Next.

Configure OAuth Payload

On the Configure OAuth payload page, configure the following settings:

• App name: Enter a name for the payload.
• App logo: Select Browse to select a .png, .jpeg, or .gif file to use. To remove a file after you've selected it, select Remove.
• Select app scope: Choose one of the following values:
  • Read user calendars
  • Read user contacts
  • Read user mail
  • Read all chat messages
  • Read all files that user can access
  • Read and write access to user mail
  • Send mail as a user

When you're finished on the Configure OAuth payload page, select Next.

Target users

On the Target users page, select who receives the simulation. Use the following options to select users:

• Include all users in your organization: The unmodifiable list of users is shown in groups of 10. You can use Next and Previous below the list of users to scroll through the list. You can also use Search on the page to find specific users.

  Tip

  Although you can't remove users from the list on this page, you can use the next Exclude users page to exclude specific users.

• Include only specific users and groups: At first, no users or groups are shown on the Targeted users page. To add users or groups to the simulation, choose one of the following options:

  • Add users: In the Add users flyout that opens, you find and select users and groups to receive the simulation. The following group types are supported:

    • Microsoft 365 Groups (static and dynamic)
    • Distribution groups (static only)
    • Mail-enabled Security group (static only)

    Tip

    Currently, hidden membership groups aren't supported.

    The following search tools are available:

    • Search for users or groups: If you click in the Search box and do one of the following actions, the Filter users by categories options on the Add users flyout are replaced by a User list section:

      • Type three or more characters and then press the ENTER key. Any users or group names that contain those characters are shown in the User list section by Name, Email, Job title, and Type.
      • Type less than three characters or no characters and then press the ENTER key. No users are shown in the User list section, but you can type three or more characters in the Search box to search for users and groups.

      The number of results appears in the Selected (0/x) users label.

      Tip

      Selecting Add filters clears and replaces any results the User list section with Filter users by categories.

      When you have a list of users or groups in the User list section, select some or all of the results by selecting the check box next to the Name column. The number of selected results appears in the Selected (y/x) users label.

      Select Add x users to add the selected users or groups on the Target users page and to return to the Target users page.

    • Filter users by categories: Use the following options:

      • Suggested user groups: Select from the following values:

        • All suggested user groups: The same result as selecting Users not targeted by a simulation in the last three months and Repeat offenders.
        • Users not targeted by a simulation in the last three months
        • Repeat offenders: For more information, see Configure the repeat offender threshold.

      • User tags: User tags are identifiers for specific groups of users (for example, Priority accounts). For more information, see User tags in Microsoft Defender for Office 365. Use the following options:

        • Search: In Search by user tags, you can type part of the user tag name and then press Enter. You can select some or all of the results.
        • Select All user tags
        • Select existing user tags. If the link is available, select See all user tags to see the complete list of available tags.

      • City: Use the following options:

        • Search: In Search by City, you can type part of the City value and then press Enter. You can select some or all of the results.
        • Select All City
        • Select existing City values. If the link is available, select See all Cities to see the complete list of available City values.

      • Country: Use the following options:

        • Search: In Search by Country, you can type part of the Country/region value and then press Enter. You can select some or all of the results.
        • Select All Country
        • Select existing City values. If the link is available, select See all Countries to see the complete list of available Country/region values.

      • Department: Use the following options:

        • Search: In Search by Department, you can type part the Department value and then press Enter. You can select some or all of the results.
        • Select All Department
        • Select existing Department values. If the link is available, select See all Departments to see the complete list of available Department values.

      • Title: Use the following options:

        • Search: In Search by Title, you can type part of the Title value and then press Enter. You can select some or all of the results.
        • Select All Title
        • Select existing Title values. If the link is available, select See all Titles to see the complete list of available Title values.

      

      You can use some or all of the search categories to find users and groups. If you select multiple categories, the AND operator is used. Any users or groups must match both values to be returned in the results (which is virtually impossible if you use the value All in multiple categories).

      The number of values that were used as the search criteria by a specific category is shown next to the category tile (for example, City 50 or Priority accounts 10).

      When you're finished searching by category, select the Apply(x) button. The previous Filter users by categories options on the Add users flyout are replaced by the following information:

      • Filters section: Show how many filter values you used and the names of the filter values. If it's available, select the See all link to see all filter values
      • User list section: Shows the users or groups that match your category searches. The number of results appears in the Selected (0/x) users label.

      When you have a list of users or groups in the User list section, select some or all of the results by selecting the check box next to the Name column. The number of selected results appears in the Selected (y/x) users label.

      Select the Add x users button to add the selected users or groups on the Target users page and to return to the Target users page.

  • Import: In the dialog that opens, specify a CSV file that contains one email address per line.

    After you find a select the CSV file, the users are imported and shown on the Targeted users page.

  On the main Target users page, you can use the Search box to find selected users. You can also select Delete and then Confirm in the confirmation dialog to remove specific users.

  To add more users and groups, select Add users or Import on the Target users page and repeat the previous steps.

When you're finished on the Target users page, select Next.

Exclude users

On the Exclude users page, you can select Exclude some of the targeted users from this simulation to exclude users that would otherwise be included based on your previous selections on the Target users page.

The methods to find and select users are the same as described in the previous section for Include only specific users and groups.

When you're finished on the Exclude users page, select Next.

Assign training

On the Assign training page, you can assign trainings for the simulation. We recommend that you assign training for each simulation, as employees who go through training are less susceptible to similar attacks.

Use the following options on the page to assign trainings as part of the simulation:

• Preferences section: In Select training content preference, choose one of the following options in the dropdown list:

  • Microsoft training experience (Recommended): This value is the default. Microsoft training experience (Recommended) has the following associated options to configure on the page:

    • Select one of the following values:
      • Assign training for me (Recommended): This value is the default. We assign training based on a user's previous simulation and training results.
      • Select training courses and modules myself: If you select this value, the next step in the wizard is Training assignment where you find and select trainings. The steps are described in the Training assignment subsection.
    • Due date section: In Select a training due date, choose one of the following values:
      • 30 days after simulation ends (this value is the default)
      • 15 days after simulation ends
      • 7 days after simulation ends

  • Redirect to a custom URL: Redirect to a custom URL has the following associated options to configure on the page:

    • Custom training URL (required)
    • Custom training name (required)
    • Custom training description
    • Custom training duration (in minutes): The default value is 0, which means there's no specified duration for the training.
    • Due date section: In Select a training due date, choose one of the following values:
      • 30 days after simulation ends (this value is the default)
      • 15 days after simulation ends
      • 7 days after simulation ends

  • No training: If you select this value, the only option on the page is Next.

When you're finished on the Assign training page, select Next.

Training assignment

On the Training assignment page, select the trainings that you want to add to the simulation by selecting Add trainings.

In the Add training flyout that opens, use the following tabs to select trainings to include in the simulation:

• Recommended tab: Shows the recommended built-in trainings based on the simulation configuration. These trainings are the same trainings that would have been assigned if you selected Assign training for me (Recommended) on the previous page.
• All trainings tab: Shows all built-in trainings that are available.

On either tab, the following information is shown for each training:

• Training name
• Source: The value is Global.
• Duration (mins)
• Preview: Select Preview to see the training.

On either tab, you can use the Search box to find trainings. Type part of the training name and press the ENTER key.

On either tab, select one or more trainings by selecting the check box next to the training name. To select all trainings, select the check box in the Training name column header. When you're finished, select Add.

Back on the Training assignment page, the selected trainings are now listed. The following information is shown for each training:

• Training name

• Source

• Duration (mins)

• Assign to: For each training, select who gets the training by selecting from the following values:

  • All users
  • One or both of the values Clicked payload or Compromised.

  Tip

  Clicked payload doesn't apply to every social engineering technique. For more information, see Training assignment trigger behavior by technique.

• Delete: Select Delete to remove the training from the simulation.

When you're finished on the Training assignment page, select Next.

Select a landing page

On the Select phish landing page page, configure the web page that users are taken to if they open the payload in the simulation.

Select one of the following options:

• Use landing pages from library: The following options are available:

  • Payload indicators section: Select Add payload indicators to email to help users learn how do identify phishing email.
    • Add payload indicators to email isn't available if you selected Malware Attachment or Link to Malware on the Select a social engineering technique page.
    • For landing pages that you create on the Tenant landing pages tab, this setting is meaningful only if you use the Dynamic tag named Insert Payload content in the landing page content as described in the Create landing pages subsection.
  • Show the interstitial page before the landing page: Show the interstitial page before the landing page is available only if you selected Drive-by URL on the Select a social engineering technique page. You can show the overlay that comes up for drive-by URL attacks. To hide the overlay and go directly to the landing page, don't select this option.

  The remainder of the Selecting phish landing page page has two tabs where you select the landing page to use:

  • Global landing pages tab: Contains the built-in landing pages. When you select a built-in landing page to use by selecting the check box next to name, an Edit layout section appears with the following options:

    • Add logo: Select Browse logo image to find and select a .png, .jpeg, or .gif file. The logo size should be a maximum of 210 x 70 to avoid distortion. To remove the logo, select Remove uploaded logo image.
    • Select default language: This setting is required. Select one of the following values: Chinese (Simplified), Chinese (Traditional, Taiwan), Dutch, English, Spanish, French, German, Italian, Japanese, Korean, Portuguese, or Russian.

  • Tenant landing pages tab: Contains any custom landing pages that you created. To create a new landing page, select Create new. The creation steps are the same as at Attack simulation training > Content library tab > Phish landing pages > Tenant landing pages tab. For instructions, see Create landing pages.

  On both tabs, the following information is shown for each landing page. You can sort the landing pages by clicking on an available column header. Select Customize columns to change the columns that are shown. The default columns are marked with an asterisk (^*):

  • Name^*
  • Language^*: If the landing page contains multiple translations, the first two languages are shown directly. To see the remaining languages, hover over the numeric icon (for example, +10).
  • Source
  • Default language^*
  • Status^*
  • Linked simulations^*
  • Created by
  • Created time^*
  • Modified by^*
  • Last modified^*

  To find a landing page in the list, type part of the landing page name in the Search box and then press the ENTER key.

  Select Filter to filter the landing pages by language.

  When a landing page is selected, if you click anywhere in the row, a details flyout opens that shows more information about the landing page:

  • The Preview tab shows what the landing page looks like to users.
  • The Details tab shows the properties of the landing page.

  Tip

  To see details about other landing pages without leaving the details flyout, use Previous item and Next item at the top of the flyout.

  When you're finished in the landing page details flyout, select Close.

  On the Selecting phish landing page page, select a landing page to use by selecting the check box next to the Name column.

• Use a custom URL: Use a custom URL isn't available if you selected Malware Attachment or Link to Malware on the Select technique page.

  If you select Use a custom URL, you need to add the URL in the Enter the custom landing page URL box that appears. No other options are available on the Selecting phish landing page page.

When you're finished on the Selecting phish landing page page, select Next.

Select end user notifications

On the Select end user notification page, select from the following notification options:

• Do not deliver notifications: No other configuration options are available on the page. Users don't receive Training assignment notifications, Training reminder notifications or Positive reinforcement notifications from the simulation. Select Proceed in the warning dialog.

• Microsoft default notification (recommended): The notifications that users receive are shown on the page:

  • Microsoft default positive reinforcement notification (for the How-to Guide social engineering technique, this notification is the only available notification)
  • Microsoft default training assignment notification
  • Microsoft default training reminder notification

  Select the default language to use in Select default language. The available values are: Chinese (Simplified), Chinese (Traditional, Taiwan), English, French, German, Italian, Japanese, Korean, Portuguese, Russian, Spanish, Dutch, Polish, Arabic, Finnish, Greek, Hungarian, Indonesian, Norwegian Bokmål, Romanian, Slovak, Swedish, Thai, Turkish, Vietnamese, Catalan, Croatian, or Slovenian.

  For each notification, the following information is available:

  • Notifications: The name of the notification.

  • Language: If the notification contains multiple translations, the first two languages are shown directly. To see the remaining languages, hover over the numeric icon (for example, +10).

  • Type: One of the following values:

    • Positive reinforcement notification
    • Training assignment notification
    • Training reminder notification

  • Delivery preferences: You need to configure the following delivery preferences before you can continue:

    • For Microsoft default positive reinforcement notification, select Do not deliver, Deliver after campaign ends, or Deliver during campaign.
    • For Microsoft default training reminder notification, select Twice a week or Weekly.

  • Actions: If you select View, a Review notification page opens with the following information:

    • Preview tab: View the notification message as users see it. To view the message in different languages, use the Select notification language box.