# US 12,015,633 B2 · System and method for conducting social engineering red team campaigns > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 12,015,633 B2 - Document ID: US12015633B2 - Status: Granted - Kind: B2 - Application number: 17/464,230 - Filed: 2021-09-01 - Published: 2022-03-03 - Granted: 2024-06-18 - Earliest claimed: 2020-09-01 - Assignees: Thomson Reuters Enterprise Centre GmbH - Applicants: Thomson Reuters Enterprise Centre GmbH - Inventors: Jason Thomas; Zach Seid; Blake Howald; James Tuttle; Spencer Torene; Hannah Lensing; Casey Fallin; Matt Machado; Berk Ekmekci; William Garcia; Nathan Maynes - Web page: https://patentgrep.com/patent/US12015633B2 ## CPC - H04L 63/1433: {Vulnerability analysis} - H04L 63/1483: {service impersonation, e.g. phishing, pharming or web spoofing (detection of rogue wireless access points H04W12/12)} - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract Computer implemented methods are provided for facilitating social engineering campaigns. The methods generally include maintaining at least one database that includes metadata for a plurality of fictional personas, metadata for a plurality of potential targets, information for a plurality of social engineering campaigns, such as a plurality of campaign scenarios, and information regarding social engineering successes with respect to at least one fictional persona, at least one potential target, at least one social engineering campaign, or a combination thereof. The method further includes receiving a selection of a campaign scenario from the plurality of campaign scenarios, receiving a selection of at least one of the plurality of potential targets, and selecting at least one of the plurality of fictional personas for use in a social engineering campaign based on an expected effectiveness of the given fictional personas with respect to the selected targets. ## Claims ### Claim 1 A computer implemented method for facilitating social engineering campaigns, the method comprising: maintaining, by a computer, at least one database comprising: metadata for a plurality of fictional personas; metadata for a plurality of potential targets; information for a plurality of social engineering campaigns, including a plurality of campaign scenarios; and information regarding social engineering successes with respect to at least one of: at least one fictional persona, at least one potential target, at least one social engineering campaign, or a combination thereof; receiving, by the computer, a selection of a campaign scenario from the plurality of campaign scenarios; receiving, by the computer, a selection of at least one of the plurality of potential targets; selecting, by the computer, at least one of the plurality of fictional personas for use in a social engineering campaign based on an expected effectiveness of the at least one of the plurality of fictional personas, the expected effectiveness determined based at least in part on metadata associated with the selected at least one of the plurality of potential targets; populating, by the computer, a communication template associated with the selected campaign scenario with metadata for a selected target and a selected fictional persona; sending, by the computer, a communication using the populated communication template to the selected target; tracking, by the computer, interactions with the selected target; accessing, by a dialog manager computer, the at least one database, the selection of the campaign scenarios, the selected target, the populated communication template and the tracked interactions with the selected target; and managing, by the dialog manager computer, a plurality of states and a flow of communications with the selected target. ### Claim 2 (depends on 1) The method of claim 1, wherein selecting at least one of the plurality of fictional personas for use in the social engineering campaign is performed at least in part using at least one model trained to identify fictional personas. ### Claim 3 (depends on 2) The method of claim 2, wherein the at least one model is trained using metadata for a plurality of potential targets and success information associated therewith as input. ### Claim 4 (depends on 2) The method of claim 2, wherein the at least one model is trained using metadata for a plurality of fictional personas and success information associated therewith. ### Claim 5 (depends on 2) The method of claim 2, wherein the at least one model is trained using campaign parameters for a plurality of campaigns and success information associated therewith. ### Claim 6 (depends on 5) The method of claim 5, wherein the campaign parameters include communication channels and wherein the at least one model is trained using success information associated with the communication channels. ### Claim 7 (depends on 5) The method of claim 5, wherein each of the scenarios has content associated therewith, and wherein the at least one model is trained using success information associated with the scenario content. ### Claim 8 (depends on 1) The method of claim 1, comprising receiving a selection of a campaign goal and setting initial campaign parameters based on the selected goal. ### Claim 9 (depends on 8) The method of claim 8, wherein the initial campaign parameters comprise a communication channel, a scenario, and fictional persona metadata. ### Claim 10 (depends on 1) The method of claim 1, wherein at least some of the metadata for the plurality of potential targets is retrieved from one or more public sources and wherein the plurality of states include an initialization state, an update state, an information update state and an end state. ### Claim 11 (depends on 1) The method of claim 1, comprising receiving at least one item of metadata for a fictional persona and generating using at least one model at least one other item of metadata for the fictional persona conforming to metadata received; wherein the fictional persona conforming to metadata received includes conforming to a regional norm and a cultural norm. ### Claim 12 (depends on 11) The method of claim 11, wherein the fictional persona is a company and wherein the at least one item of metadata received comprises an industry type and location and wherein the at least one other item of metadata comprises a company name. ### Claim 13 (depends on 11) The method of claim 11, wherein the fictional persona is a company and wherein the at least one other item of metadata comprises company structure. ### Claim 14 (depends on 13) The method of claim 13, wherein the company structure comprises a plurality of company employees and at least one company address. ### Claim 15 (depends on 11) The method of claim 11, wherein the fictional persona is a company and wherein the at least one other item of metadata comprises a domain name for the company website. ### Claim 16 (depends on 1) The method of claim 1, wherein selecting at least one of the plurality of fictional personas for use in a social engineering campaign comprises providing an interface that includes a list of fictional personas, a list of potential targets, and at least one form element for a user to refine the list of fictional personas based on a score for the fictional personas regarding effectiveness of each of the fictional persona with respect to at least one of the potential target listed. ### Claim 17 A computer implemented method for facilitating social engineering campaigns, the method comprising: receiving, by a computer, at least one item of metadata for a first fictional persona; generating, by the computer, using at least one trained model, at least one other item of metadata for the fictional persona conforming to metadata received; maintaining, by the computer, at least one database comprising: metadata for a plurality of fictional personas, including the first fictional persona; metadata for a plurality of potential targets; information for a plurality of social engineering campaigns, including a plurality of campaign scenarios; and information regarding social engineering successes with respect to at least one of: at least one fictional persona, at least one potential target, at least one social engineering campaign, or a combination thereof; receiving, by the computer, a selection of a campaign scenario from the plurality of campaign scenarios; receiving, by the computer, a selection of at least one of the plurality of potential targets; selecting, by the computer, at least one of the plurality of fictional personas for use in a social engineering campaign using the at least one trained model, the selection based on an expected effectiveness of the at least one of the plurality of fictional personas with respect to the selected at least one of the plurality of potential targets, the at least one trained model trained with respect to expected effectiveness using as input: metadata for a plurality of potential targets and success information associated therewith as input; metadata for a plurality of fictional personas and success information associated therewith; campaign parameters for a plurality of campaigns and success information associated therewith; or populating, by the computer, a communication template associated with the selected campaign scenario with metadata for a selected target and a selected fictional persona; sending, by the computer, a communication using the populated communication template to the selected target; tracking, by the computer, interactions with the selected target; accessing, by a dialog manager computer, the at least one database, the selection of the campaign scenarios, the selected target, the populated communication template and the tracked interactions with the selected target; and managing, by the dialog manager computer, a plurality of states and a flow of communications with the selected target. ### Claim 18 (depends on 17) The method of claim 17, wherein generating the at least one other item of metadata for the fictional persona conforming to metadata received includes conforming to a regional norm and a cultural norm and wherein the campaign parameters include communication channels and wherein the at least one trained model is trained using success information associated with the communication channels. ### Claim 19 (depends on 17) The method of claim 17, wherein each of the scenarios has content associated therewith, and wherein the at least one trained model is trained using success information associated with the scenario content and wherein the plurality of states include an initialization state, an update state, an information update state and an end state. ### Claim 20 (depends on 17) The method of claim 17, wherein selecting at least one of the plurality of fictional personas for use in a social engineering campaign comprises providing an interface that includes a list of fictional personas, a list of potential targets, and at least one form element for a user to refine list of fictional personas based on a score for the fictional personas regarding effectiveness of each of the fictional persona with respect to at least one of the potential target listed.