Secure Email Threat Simulation for Targeted Attack Prevention

How to Use Keepnet’s E-Mail Threat Simulator for Advanced Email Security

In 2024, targeted email attacks continue to rise, especially against large corporations, government agencies, and political organizations. Despite sophisticated filters, email remains one of the most common entry points for cyberattacks. Even the best filters can be misconfigured, leading organizations to think they’re safer than they are. Keepnet's E-Mail Threat Simulator helps assess these vulnerabilities, offering a reliable way to measure, analyze, and improve email security. Learn more: What Is Security Awareness Training.

The Growing Need for Email Threat Simulations

Over the past decade, attackers have focused increasingly on email-based attacks due to the sensitive data often accessible via corporate email accounts. Today’s organizations store large amounts of information, making them appealing targets. Keepnet's simulator offers a unique method to strengthen your defense against these threats by evaluating your current security setup and identifying hidden vulnerabilities in email configurations.

Creating a Secure Test Account for Email Threat Simulation

To accurately test your email security setup, Keepnet’s Email Threat Simulator requires a test account. This account serves as a sandbox, allowing the simulator to conduct security checks and provide reliable reports on vulnerabilities. Here’s how to configure a secure test account and ensure it complies with your organization's security requirements.

Step 1: Creating a Test Account in Exchange

Start by setting up the test account with Exchange Management Shell, which requires Organization Administration permissions. Here’s a sample command to create your test mailbox account:

New-Mailbox -UserPrincipalName ets@yourdomain.com -Alias ets -Name ETS -Database PERDB -OrganizationalUnit OU=SNR,DC=keepnet,DC=aws -ResetPasswordOnNextLogon $false –password (ConvertTo-SecureString -String 'StR0ngP@ssw0rd' -AsPlainText -Force)

This mailbox is dedicated solely to receiving simulated threat emails without the risk of sending emails to external or internal addresses, ensuring that all simulations are contained and secure.

Step 2: Restricting the Test Account’s Permissions

To ensure the test account operates safely, configure restrictions that prevent it from sending or receiving emails outside the test parameters. Use Exchange Admin Center (EAC) for this process.

1. Log in to Exchange Server with Organization Admin authority.
2. Go to Mail Flow > Rules.
3. Add a new rule with the conditions:

• Apply this rule if: The sender is the test account.
• Do the following: Delete the message without notifying anyone.

4.In More Options, set an exception to allow emails sent to ets@keepnethood.com.

These restrictions ensure that the test account can only receive emails directly related to the email threat simulations.

Enable Mailbox Audit Logging for the Test Account

By default, mailbox audit logging is disabled for new mailboxes on Exchange servers. Activating this feature allows you to log every action taken with the test account, ensuring compliance and tracking activity accurately.

To enable audit logging, use the following command:

Set-Mailbox -Identity "ETS Test Account" -AuditEnabled $true

To enable audit logging across all mailboxes:

Get-Mailbox -ResultSize Unlimited -Filter {RecipientTypeDetails -eq "UserMailbox"} | Set-Mailbox -AuditEnabled $true

These logs allow detailed tracking of actions taken by admins and authorized users on the test account, providing a layer of accountability and ensuring that no unauthorized changes are made.

Customizing Audit Logs for Different User Groups

Audit logs can be customized to capture specific actions taken by different user groups:

Set-Mailbox -Identity "ETS Test Account" -AuditAdmin Update, Move, MoveToDeletedItems, SoftDelete, HardDelete, FolderBind, SendAs, SendOnBehalf, Create -AuditDelegate Update, Move, MoveToDeletedItems, SoftDelete, HardDelete, FolderBind, SendAs, SendOnBehalf, Create -AuditEnabled $true

This command specifies which actions to log for admins, delegates, and the mailbox owner, allowing you to tailor logging to meet compliance needs without overcrowding logs.

Enabling Admin Audit Logging for Security Compliance

Another important configuration involves Admin Audit Logging, which records commands run by admins on the server. By enabling this log, you can track configuration changes, enhancing accountability across the server.

To activate Admin Audit Logging:

Set-AdminAuditLogConfig -AdminAuditLogEnabled $true -AdminAuditLogParameters * -AdminAuditLogCmdlets *

This command records any configuration changes made by administrators. For example, you can search through admin logs for specific changes using:

Search-AdminAuditLog -cmdlets New-Sendconnector -startdate 04/20/2023 -enddate 04/25/2023

To receive automated reports on specified events, such as Mailbox Quota Changes, use the following command:

New-AdminAuditLogSearch -Name "Mailbox Quota Change Audit" -Cmdlets Set-Mailbox -Parameters UseDatabaseQuotaDefaults, ProhibitSendReceiveQuota, ProhibitSendQuota -StartDate 01/20/2024 -EndDate 01/30/2024 -StatusMailRecipients admin@yourdomain.com

Final Thoughts on Secure Email Simulation

By creating a restricted, audit-logged test account, Keepnet’s Email Threat Simulator can safely identify weaknesses within your organization’s email security. With the rise of targeted attacks, this proactive approach helps organizations better understand and improve their defenses, ensuring that email security configurations are continuously evaluated and refined.

For more insights into email threat simulations and broader cybersecurity measures, explore Keepnet's Phishing Simulator and Security Awareness Training resources.

What Better Program Design Looks Like

Secure Email Threat Simulation for Targeted Attack Prevention works best when the content reflects how people actually make decisions. Strong programs do not try to teach everything at once. They focus on the few behaviors that create the most risk, then reinforce them with current examples, timely reminders, and clear reporting paths.

That is also what makes training easier to defend internally. When a program changes behavior, reduces repeat-risk patterns, or improves reporting quality, leaders can see how awareness supports real business outcomes instead of acting like a standalone compliance activity.

Keepnet teams usually see the biggest gains when training is tied to a reporting path and a follow-up workflow. For most organizations, the common mistake is treating secure email threat simulation for targeted attack prevention as content delivery instead of behavior design.

Program Checklist

• Choose the user decisions that matter most instead of covering every possible topic.
• Use short modules, current examples, and realistic follow-up after incidents or simulations.
• Measure reporting, repeat risk, and remediation behavior, not only completions.
• Give managers and team leads a role in reinforcing the habits you want to build.