How to enable Arsen phishing simulations using headers on Microsoft Office 365?

This procedure allows you to authorize our phishing simulations on your employees' email addresses by identifying them with a specific header on Microsoft 365.

This method is only recommended if you have a filtering solution upstream of your reception servers. In practical terms, this means that you need to whitelist our IP on your anti-phishing filter and then apply the header procedure on Microsoft Office 365.

If you don't have an upstream filtering solution for your emails, always prefer to use an IP address-based whitelisting procedure.

Remember to authorize our header or IP on your anti-spam or anti-phishing service to ensure the proper reception of our simulations.

• Prerequisites
• Step 1: Bypassing anti-spam and anti-clutter protection
• Step 2: Avoid Quarantine

Prerequisites

To follow this procedure, you must be the administrator of your company's Microsoft 365 account.

Step 1 : Bypassing anti-spam and anti-clutter protection

1. Log in to your administration portal and select Exchange under Administration Centers.

2. In Mail Flow, click on Rules.

3. Click on the + to add a rule and select Bypass Spam Filtering.

4. In the new rule window, choose a name like Arsen Anti-Phishing Authorization.

5. Select A message header in the Apply this rule if... menu, then select Includes any of these words.

6. On the right side, click the first Enter text...

7. And in the new window, enter the value of the header.

8. In the second Enter text..., enter "true" and click on the save button. The text should look like this:

9. In Do the following..., make sure that Set the spam confidence level (SCL) to... is selected and that Bypass spam filtering is set to the right.

10. Click on + to add an action

11. Select Modify the message properties and then Set a message header.

12. Click the first Enter text... and enter X-MS-Exchange-Organization-BypassClutter. Then click the second Enter text... and enter true.

13. Leave the other options as default, then click Next

Step 2: Avoid Quarantine

This part of the procedure prevents our phishing simulations from being quarantined.

1. Still in the Exchange Admin Center, select "Mail Flow" and then "Rules" in the left menu.

2. Click the "+" button to add a rule.

3. Select "Bypass spam filtering"....
   
   

4. ...and name the rule Arsen Quarantine Avoidance.

5. Click on "Apply this rule if..." and select A message header. Then select includes any of these words.

6. In the first Enter text... field, enter the value of the header. By default, this value is X-Arsen-Training, but we strongly recommend following the header customization procedure for greater security.

7. In the second Enter text... field, enter the text true and click the Save button.

8. Click the Do the following... dropdown, select Modify the message properties, then select Set a Message Header.

9. Click the first Enter text... to the right of "Set the message header" to define the header. Enter the text X-Forefront-Antispam-Report. Pay attention to capitalization: respect upper and lower case. Click OK.

10. Click the second Enter text... after to the value to the right of Set the message header. Enter SFV:SKI;CAT:NONE;. Respect the capitalization: everything must be in uppercase. Click OK once the text is entered. Here is the final configuration of the rule:

11. Click Next

Updated on: 29/01/2024