# US 2021/0344713 A1 · Systems and methods for reporting based simulated phishing campaign > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 2021/0344713 A1 - Document ID: US20210344713A1 - Status: Published application - Kind: A1 - Application number: 17/233,269 - Filed: 2021-04-16 - Published: 2021-11-04 - Earliest claimed: 2020-04-29 - Assignees: KnowBe4, Inc. - Applicants: KnowBe4, Inc. - Inventors: Greg Kras; Alin Irimie - Web page: https://patentgrep.com/patent/US20210344713A1 ## CPC - H04L 63/1491: {using deception as countermeasure, e.g. honeypots, honeynets, decoys or entrapment} - G06F 21/552: {involving long-term monitoring or reporting} - H04L 51/046: Interoperability with other network applications or services - H04L 51/18: Commands or executable codes - H04L 51/212: using filtering or selective blocking - H04L 51/42: Mailbox-related aspects, e.g. synchronisation of mailboxes - H04L 63/1408: {by monitoring network traffic (monitoring network traffic per se H04L43/00)} - H04L 63/1483: {service impersonation, e.g. phishing, pharming or web spoofing (detection of rogue wireless access points H04W12/12)} - G09B 19/0053: {Computers, e.g. programming} - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) - G09B: EDUCATIONAL OR DEMONSTRATION APPLIANCES; APPLIANCES FOR TEACHING, OR COMMUNICATING WITH, THE BLIND, DEAF OR MUTE; MODELS; PLANETARIA; GLOBES; MAPS; DIAGRAMS (devices for psychotechnics or for testing reaction times A61B5/16; games, sports, amusements A63; projectors, projector screens G03B) ## Abstract Systems and methods are described for leveraging the knowledge and security awareness of well-informed users in an organization to protect other users and train them to identify new phishing attacks. Initially, a report of a message being suspicious may be identified and it may be determined whether message is a malicious phishing message. In an example, a well-informed user of an organization may report the message as suspicious. Further, on determining the message to be a malicious phishing message, a simulated phishing message or a template may be created. The simulated phishing message may then be communicated to one or more devices of one or more users. ## Claims ### Claim 1 A method for using a reported suspicious message to create a simulated phishing message, the method comprising: (a) identifying, by one or more processors, a report of a message being suspicious; (b) determining, by the one or more processors, that the message is a malicious phishing message; (c) creating, by the one or more processors responsive to the determination and based at least on the message, a simulated phishing message or a template for the simulated phishing message; (d) communicating, by the one or more processors, the simulated phishing message to one or more devices of one or more users. ### Claim 2 (depends on 1) The method of claim 1, wherein (a) further comprises receiving, by the one or more processors, a forward of the email identified as potentially malicious. ### Claim 3 (depends on 1) The method of claim 1, wherein (a) further comprises identifying, by the one or more processors, the email being suspicious in a mailbox of the one or more users. ### Claim 4 (depends on 1) The method of claim 1, wherein (b) further comprises determining, by the one or more processors, that the email is a malicious phishing email using a rule set of one or more characteristic detection rules. ### Claim 5 (depends on 1) The method of claim 1, wherein (c) further comprising removing, by the one or more processors, one or more malicious elements of the message to create the simulated phishing message or the template for the simulated phishing message. ### Claim 6 (depends on 1) The method of claim 1, wherein (c) further comprising modifying, by the one or more processors, one or more malicious elements of the message to create the simulated phishing message or the template for the simulated phishing message. ### Claim 7 (depends on 1) The method of claim 1, wherein (c) further comprising modifying, by the one or more processors, one or more links of the message to create the simulated phishing message or the template for the simulated phishing message to include one or more links to training content when interacted with by a user. ### Claim 8 (depends on 1) The method of claim 1, wherein (c) further comprising creating, by the one or more processors, the template to be customizable to include one of a specific user reference or content. ### Claim 9 (depends on 1) The method of claim 1, wherein (d) further comprising causing, by the one or more processors, the message in a messaging application of a user to be replaced with the simulated phishing message. ### Claim 10 (depends on 1) The method of claim 1, further comprising causing, by the one or more processors, the simulated phishing message to be moved from one of a delete or trash folder of the messaging application of the user to an inbox of the messaging application. ### Claim 11 A system for using a reported suspicious message to create a simulated phishing message, the system comprising: one or more processors, coupled to memory, and configured to: identify a report of a message being suspicious; determine that the message is a malicious phishing message; create, responsive to the determination and based at least on the message, a simulated phishing message or a template for the simulated phishing message; and communicate the simulated phishing message to one or more devices of one or more users. ### Claim 12 (depends on 11) The system of claim 11, wherein the one or more processors are further configured to receive a forward of the email identified as potentially malicious. ### Claim 13 (depends on 11) The system of claim 11, wherein the one or more processors are further configured to identify the email being suspicious in a mailbox of the one or more users. ### Claim 14 (depends on 11) The system of claim 11, wherein the one or more processors are further configured to determine that the email is a malicious phishing email using a rule set of one or more characteristic detection rules. ### Claim 15 (depends on 11) The system of claim 11, wherein the one or more processors are further configured to remove one or more malicious elements of the message to create the simulated phishing message or the template for the simulated phishing message. ### Claim 16 (depends on 11) The system of claim 11, wherein the one or more processors are further configured to modify one or more malicious elements of the message to create the simulated phishing message or the template for the simulated phishing message. ### Claim 17 (depends on 11) The system of claim 11, wherein the one or more processors are further configured to modify one or more links of the message to create the simulated phishing message or the template for the simulated phishing message to include one or more links to training content when interacted with by a user. ### Claim 18 (depends on 11) The system of claim 11, wherein the one or more processors are further configured to create the template to be customizable to include one of a specific user reference or content. ### Claim 19 (depends on 11) The system of claim 11, wherein the one or more processors are further configured to cause the message in a messaging application of a user to be replaced with the simulated phishing message. ### Claim 20 (depends on 11) The system of claim 11, wherein the one or more processors are further configured to cause the simulated phishing message to be moved from one of a delete or trash folder of the messaging application of the user to an inbox of the messaging application.