# US 2018/0027014 A1 · Systems and methods for performing a simulated phishing attack > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 2018/0027014 A1 - Document ID: US20180027014A1 - Status: Published application - Kind: A1 - Application number: 15/720,566 - Filed: 2017-09-29 - Published: 2018-01-25 - Earliest claimed: 2016-06-28 - Assignees: KnowBe4, Inc. - Applicants: KnowBe4, Inc. - Inventors: Alin Irimie; Stu Sjouwerman; Brian Jack - Web page: https://patentgrep.com/patent/US20180027014A1 ## CPC - H04L 63/1483: {service impersonation, e.g. phishing, pharming or web spoofing (detection of rogue wireless access points H04W12/12)} - G06Q 10/0639: Performance analysis of employees; Performance analysis of enterprise or organisation operations - H04L 51/18: Commands or executable codes - H04L 51/23: Reliability checks, e.g. acknowledgments or fault reporting - H04L 51/42: Mailbox-related aspects, e.g. synchronisation of mailboxes - H04L 63/1425: {Traffic logging, e.g. anomaly detection} - H04L 63/1433: {Vulnerability analysis} - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) - G06Q: INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR ## Abstract Systems and methods for performing a simulated phishing attack are provided. A simulated attack server can send a simulated attack email including a unique identifier to a target. The simulated attack server can receive a reply email including the unique identifier from the target. The simulated attack server can extract the unique identifier from the reply email. The simulated attack server can determine a match between the unique identifier and an identity of the target. The simulated attack server can record a target failure, responsive to determining the match between the unique identifier and the identity of the target. ## Claims ### Claim 1 A method for identifying users that reply to a simulated phishing email, the method comprising: (a) establishing, by one or more servers comprising one or more processors coupled to memory, a unique identifier for each user of a plurality of users; (b) embedding, by the one or more servers, the unique identifier of a user in a simulated phishing email to be communicated to that user, the simulated phishing email comprising an email address in a to field that corresponds to the one or more servers; (c) receiving, by the one or more servers, a reply email to the email address communicated responsive to the simulated phishing email being communicated to the email account of at least one user of the plurality of users, the reply email comprising the unique identifier; and (d) determining, by the one or more servers, that a user has replied to the simulated phishing email by identifying the unique identifier embedded in the reply email as the unique identifier established by the one or more servers for the user. ### Claim 2 (depends on 1) The method of claim 1, wherein (a) further comprises establishing, by the one or more servers, the unique identifier to identify the user corresponding to one or more email accounts. ### Claim 3 (depends on 1) The method of claim 1, wherein (b) further comprises embedding the unique identifier of the user in at least one of a subject line of the simulated phishing email, a body of the simulated phishing email or an attachment of the simulated phishing email. ### Claim 4 (depends on 1) The method of claim 1, wherein (b) further comprises generating, by the one or more servers, the simulated phishing email to comprise the unique identifier of the user embedded in at least one of a subject line of the simulated phishing email, a body of the simulated phishing email or an attachment of the simulated phishing email. ### Claim 5 (depends on 1) The method of claim 1, wherein (b) further comprises embedding the unique identifier of the user to be invisible in the body of the simulated phishing email. ### Claim 6 (depends on 1) The method of claim 1, wherein (b) further comprises embedding the unique identifier of the user in a file name of the attachment. ### Claim 7 (depends on 1) The method of claim 1, wherein (b) further comprises embedding the unique identifier of the user in content of the attachment. ### Claim 8 (depends on 1) The method of claim 1, wherein (c) further comprises communicating, by the one or more servers, the simulated phishing email to an email account of each user of the plurality of users. ### Claim 9 (depends on 1) The method of claim 1, wherein (d) further comprises receiving, by the one or more servers, the reply email sent to a domain of or a domain hosted by the one or more servers. ### Claim 10 (depends on 1) The method of claim 1, wherein (d) further comprises comparing the unique identifier embedded in the reply email to the unique identifier established by the one or more servers for the user. ### Claim 11 (depends on 1) The method of claim 1, wherein (d) further comprises identifying, by the one or more servers, the unique identifier embedded in in at least one of the subject line of the simulated phishing email, the body of the simulated phishing email or the attachment of the simulated phishing email. ### Claim 12 A system for identifying users that reply to a simulated phishing email, the system comprising: one or more servers comprising one or more processors coupled to memory, and configured to establish a unique identifier for each user of a plurality of users; a campaign manager of the one or more servers configured to the unique identifier of a user in a simulated phishing email to be communicated to that user, the simulated phishing email comprising an email address in a to field that corresponds to the one or more servers; and wherein the one or more servers are configured to receive a reply email to the email address communicated responsive to the simulated phishing email being communicated to the email account of at least one user of the plurality of users, the reply email comprising the unique identifier; and wherein the campaign manager is configured to determine a user has replied to the simulated phishing email by identifying the unique identifier embedded in the reply email as the unique identifier established by the one or more servers for the user. ### Claim 13 (depends on 12) The system of claim 12, wherein the one or more servers are further configured to establish the unique identifier to identify the user corresponding to one or more email accounts. ### Claim 14 (depends on 12) The system of claim 12, wherein the one or more servers are further configured to embed the unique identifier of the respective user in at least one of a subject line of the simulated phishing email, a body of the simulated phishing email or an attachment of the simulated phishing email. ### Claim 15 (depends on 12) The system of claim 12, wherein the one or more servers are further configured to generate the simulated phishing email to comprise the unique identifier of the user embedded in at least one of a subject line of the simulated phishing email, a body of the simulated phishing email or an attachment of the simulated phishing email. ### Claim 16 (depends on 12) The system of claim 12, wherein the one or more servers are further configured to embed the unique identifier of the user to be invisible in the body of the simulated phishing email. ### Claim 17 (depends on 12) The system of claim 12, wherein the one or more servers are further configured to embed the unique identifier of the user in a file name of the attachment. ### Claim 18 (depends on 12) The system of claim 12, wherein the one or more servers are further configured to embed the unique identifier of the user in content of the attachment. ### Claim 19 (depends on 12) The system of claim 12, wherein the one or more servers are further configured to communicate the simulated phishing email to an email account of each user of the plurality of users. ### Claim 20 (depends on 12) The system of claim 12, wherein the one or more servers are further configured to receive the reply email sent to a domain of or a domain hosted by the one or more servers. ### Claim 21 (depends on 12) The system of claim 12, wherein the one or more servers are further configured to compare the unique identifier embedded in the reply email to the unique identifier established by the one or more servers for the user. ### Claim 22 (depends on 1) The method of claim 1, wherein (d) further comprises identifying, by the one or more servers, the unique identifier embedded in in at least one of the subject line of the simulated phishing email, the body of the simulated phishing email or the attachment of the simulated phishing email. ### Claim 23 A method for identifying users that reply to a simulated phishing email, the method comprising: (a) establishing, by one or more servers comprising a processor coupled to memory, a unique identifier for each user of a plurality of users; (b) embedding, by the one or more servers, the unique identifier of a user in an email address of a plurality of address fields of a simulated phishing email to be communicated to that user; (c) receiving, by the one or more servers, responsive to the simulated phishing email being communicated to the email account of a user of the plurality of users, a reply email comprising the unique identifier in at least one email address field of the plurality of address fields; and (d) determining by the one or more servers, that the user has replied to the simulated phishing email by identifying the unique identifier embedded in the at least one address field of the plurality of address fields of the reply as to the unique identifier established by the one or more servers for the user. ### Claim 24 (depends on 23) The method of claim 23, wherein (a) further comprises establishing, by the one or more servers, the unique identifier to identify one or more email accounts. ### Claim 25 (depends on 23) The method of claim 23, wherein (b) further embedding the unique identifier of the user in a to field of the simulated phishing email. ### Claim 26 (depends on 23) The method of claim 23, wherein (b) further comprises embedding the unique identifier of the respective user in a cc field of the simulated phishing email. ### Claim 27 (depends on 23) The method of claim 23, wherein (b) further comprises embedding the unique identifier of the respective user prior to an @ sign in the email address in one of the plurality of address fields. ### Claim 28 (depends on 23) The method of claim 23, wherein (b) further comprises embedding the unique identifier of the respective user after an @ sign in the email address in one of the plurality of address fields. ### Claim 29 (depends on 23) The method of claim 23, wherein (b) further comprising generating, by the one or more servers, for each user of the plurality of users the simulated phishing email to comprise the unique identifier of a respective user embedded in the email address of one of the plurality of address fields of the simulated phishing email; ### Claim 30 (depends on 23) The method of claim 23, wherein (c) further comprises communicating, by the one or more servers, the simulated phishing email to an email account corresponding to the user of the plurality of users. ### Claim 31 (depends on 23) The method of claim 23, wherein (c) further comprises receiving, by the one or more servers, the reply email sent to a domain of or hosted by the one or more servers. ### Claim 32 (depends on 23) The method of claim 23, wherein (d) further comprises identifying, by the one or more servers, the unique identifier embedded in the address field of the simulated phishing email comprising one of a from field or a cc field. ### Claim 33 A system for identifying users that reply to a simulated phishing email, the system comprising: one or more servers comprising a processor coupled to memory and configured to establish a unique identifier for each user of a plurality of users; a campaign manager of the one or more servers configured to embed the unique identifier of a user in an email address of a plurality of address fields of a simulated phishing email to be communicated to that user; wherein the one or more servers are configured to receive, responsive to the simulated phishing email being communicated to the email account of a user of the plurality of users, a reply email comprising the unique identifier in at least one email address field of the plurality of address fields; and determine that the user has replied to the simulated phishing email by identifying the unique identifier embedded in the at least one address field of the plurality of address fields of the reply as to the unique identifier established by the one or more servers for the user. ### Claim 34 (depends on 33) The system of claim 33, wherein the one or more servers are further configured to generate the unique identifier to identify one or more email accounts. ### Claim 35 (depends on 33) The system of claim 33, wherein the campaign manager is further configured to embed the unique identifier of the respective user in a to field of the simulated phishing email. ### Claim 36 (depends on 33) The system of claim 33, wherein the campaign manager is further configured to embed the unique identifier of the respective user in a cc field of the simulated phishing email. ### Claim 37 (depends on 33) The system of claim 33, wherein the campaign manager is further configured to embed the unique identifier of the respective user prior to an @ sign in the email address in one of the plurality of address fields. ### Claim 38 (depends on 33) The system of claim 33, wherein the campaign manager is further configured to embed the unique identifier of the respective user after an @ sign in the email address in one of the plurality of address fields. ### Claim 39 (depends on 33) The system of claim 33, wherein the one or more servers are further configured to generate for each user of the plurality of users the simulated phishing email to comprise the unique identifier of a respective user embedded in the email address of one of the plurality of address fields of the simulated phishing email; ### Claim 40 (depends on 33) The system of claim 33, wherein the one or more servers are further configured to communicate the simulated phishing email to an email account corresponding to the user of the plurality of users. ### Claim 41 (depends on 33) The system of claim 33, wherein the one or more servers are further configured to receive the reply email sent to a domain of or hosted by the one or more servers. ### Claim 42 (depends on 33) The system of claim 33, wherein the campaign manager is further configured to identify the unique identifier embedded in the address field of the simulated phishing email comprising one of a from field or a cc field.