Secure Email Threat Simulation for Targeted Attack Prevention

How to Use Keepnet Labs’ E-Mail Threat Simulator for Advanced Email Security

In 2024, targeted email attacks continue to rise, especially against large corporations, government agencies, and political organizations. Despite sophisticated filters, email remains one of the most common entry points for cyberattacks. Even the best filters can be misconfigured, leading organizations to think they’re safer than they are. Keepnet Labs' E-Mail Threat Simulator helps assess these vulnerabilities, offering a reliable way to measure, analyze, and improve email security.

The Growing Need for Email Threat Simulations

Over the past decade, attackers have focused increasingly on email-based attacks due to the sensitive data often accessible via corporate email accounts. Today’s organizations store large amounts of information, making them appealing targets. Keepnet Labs' simulator offers a unique method to strengthen your defense against these threats by evaluating your current security setup and identifying hidden vulnerabilities in email configurations.

Creating a Secure Test Account for Email Threat Simulation

To accurately test your email security setup, Keepnet Labs’ Email Threat Simulator requires a test account. This account serves as a sandbox, allowing the simulator to conduct security checks and provide reliable reports on vulnerabilities. Here’s how to configure a secure test account and ensure it complies with your organization's security requirements.

Step 1: Creating a Test Account in Exchange

Start by setting up the test account with Exchange Management Shell, which requires Organization Administration permissions. Here’s a sample command to create your test mailbox account:

New-Mailbox -UserPrincipalName ets@yourdomain.com -Alias ets -Name ETS -Database PERDB -OrganizationalUnit OU=SNR,DC=keepnet,DC=aws -ResetPasswordOnNextLogon $false –password (ConvertTo-SecureString -String 'StR0ngP@ssw0rd' -AsPlainText -Force)

This mailbox is dedicated solely to receiving simulated threat emails without the risk of sending emails to external or internal addresses, ensuring that all simulations are contained and secure.

Step 2: Restricting the Test Account’s Permissions

To ensure the test account operates safely, configure restrictions that prevent it from sending or receiving emails outside the test parameters. Use Exchange Admin Center (EAC) for this process.

1. Log in to Exchange Server with Organization Admin authority.
2. Go to Mail Flow > Rules.
3. Add a new rule with the conditions:

• Apply this rule if: The sender is the test account.
• Do the following: Delete the message without notifying anyone.

4.In More Options, set an exception to allow emails sent to ets@keepnethood.com.

These restrictions ensure that the test account can only receive emails directly related to the email threat simulations.

Enable Mailbox Audit Logging for the Test Account

By default, mailbox audit logging is disabled for new mailboxes on Exchange servers. Activating this feature allows you to log every action taken with the test account, ensuring compliance and tracking activity accurately.

Set-Mailbox -Identity "ETS Test Account" -AuditEnabled $true

Get-Mailbox -ResultSize Unlimited -Filter {RecipientTypeDetails -eq "UserMailbox"} | Set-Mailbox -AuditEnabled $true

These logs allow detailed tracking of actions taken by admins and authorized users on the test account, providing a layer of accountability and ensuring that no unauthorized changes are made.

Customizing Audit Logs for Different User Groups

Set-Mailbox -Identity "ETS Test Account" -AuditAdmin Update, Move, MoveToDeletedItems, SoftDelete, HardDelete, FolderBind, SendAs, SendOnBehalf, Create -AuditDelegate Update, Move, MoveToDeletedItems, SoftDelete, HardDelete, FolderBind, SendAs, SendOnBehalf, Create -AuditEnabled $true

This command specifies which actions to log for admins, delegates, and the mailbox owner, allowing you to tailor logging to meet compliance needs without overcrowding logs.

Enabling Admin Audit Logging for Security Compliance

Another important configuration involves Admin Audit Logging, which records commands run by admins on the server. By enabling this log, you can track configuration changes, enhancing accountability across the server.

Set-AdminAuditLogConfig -AdminAuditLogEnabled $true -AdminAuditLogParameters * -AdminAuditLogCmdlets *

Search-AdminAuditLog -cmdlets New-Sendconnector -startdate 04/20/2023 -enddate 04/25/2023

New-AdminAuditLogSearch -Name "Mailbox Quota Change Audit" -Cmdlets Set-Mailbox -Parameters UseDatabaseQuotaDefaults, ProhibitSendReceiveQuota, ProhibitSendQuota -StartDate 01/20/2024 -EndDate 01/30/2024 -StatusMailRecipients admin@yourdomain.com

Final Thoughts on Secure Email Simulation

By creating a restricted, audit-logged test account, Keepnet Labs’ Email Threat Simulator can safely identify weaknesses within your organization’s email security. With the rise of targeted attacks, this proactive approach helps organizations better understand and improve their defenses, ensuring that email security configurations are continuously evaluated and refined.

For more insights into email threat simulations and broader cybersecurity measures, explore Keepnet Labs' Phishing Simulator and Security Awareness Training resources.

Editor's Note: This blog was updated on November 15, 2024.