Attack Simulation Training is configured and a baseline simulation has been run in the last 12 months

Overview

Attack Simulation Training in Microsoft Defender for Office 365 P2 launches benign phishing campaigns against a tenant’s own users, measures their behavior (delivery, click, credential entry, attachment open, OAuth consent grant), and assigns role-appropriate training to users who fail. Technical defenses suppress most phishing, but a non-zero rate of malicious messages reaches inboxes; the only durable mitigation for that residual is users who recognize and report the lure rather than clicking it. Without an Attack Simulation Training program the tenant has no measurement of click rate, no stratification of repeat-clickers, no baseline against which to measure improvement, and no enforced training assignment when a user does click. Microsoft’s recommended baseline is an automated simulation series running quarterly with payloads representative of current attacker patterns, automatic training assignment from the Microsoft Training catalog, and regular review of click rate, training completion, and repeat-offender lists.

Remediation

• Get started using Attack Simulation Training
• Simulate a phishing attack
• Simulation automations
• Insights and reports

Run it

The check runs as part of the whole assessment, with the ZeroTrustAssessment module installed:

Install-Module ZeroTrustAssessment -Scope CurrentUser
Connect-Maester
Invoke-Maester -Pack ZTA -SkipBuiltIn

Leave out -SkipBuiltIn to run Maester’s own checks in the same run.

About this check

Severity	Medium
Effort to fix	Medium
Impact on users	Medium
Pillar	SecOps
Category	Email and collaboration security
Product	Defender
Feature	Tenant settings
Area	Email and collaboration protection
ATT&CK	T1566 Phishing
Licence	THREAT_INTELLIGENCE
Tenant	Workforce

Product, feature, area and ATT&CK are Maester’s: the assessment does not record them, so Maester keeps them in the pack’s taxonomy.json.

A Microsoft check, part of the Zero Trust Assessment pack. Text from ZeroTrustAssessment 3.1.0, © Microsoft, MIT licence.