LUCY comes with a "Phish Alert" plugin/addon for mail clients or browsers:

• Outlook 2016
• Outlook 2019
• Office365 Desktop
• Office365 Web
• Office365 Mobile
• Outlook for Mac
• Office for Mac 2016
• Office for Mac 2019
• Gmail

This add-in gives your users a safe way to forward suspected Emails with only one click and have them analyzed automatically by the Threat Analyzer in LUCY. The tool empowers users to proactively participate in an organization’s security program and makes it easy for your employees to report any suspicious email they receive. It has two main features

a) Forward the mail (.msg) to a predefined mail address (e.g. your security team). Within the plugin you have the ability to define a custom message that appears to the user after the mail gets reported. Once the message gets forwarded to your team, it will automatically be deleted from the user's inbox to prevent future exposure.
b) Report back to LUCY: the plugin may forward suspected phishing emails as well LUCY generated emails back to the LUCY server via HTTPS. If the mail was generated by LUCY, the reports will automatically be processed within the campaign statistics. All other emails can be analyzed in LUCY using our threat analysis engine.

There are 3 variations of the Report Plugin by design:

• Outlook Plugin
• O365 Plugin
• Gmail Plugin

The configuration of the plugin and phishing incidents is done within the settings menu (Admin/Settings/Incident Settings) where you can define the settings for:

• Custom Rules (create special rules with Regex filters to flag emails)
• Score Factors (adjust the scores for specific incident events)
• Abuse
• Autoresponder
• Plugin settings

The following settings can be configured:

Language settings are required to be configured before the initial download of the plugin from the Incidents Tab.
The language sample text (English) can be found here.

Please note, multi-language support is only available for the MSI plugin.
The locale will be set automatically according to the Outlook's language.
Otherwise the default language will be used.

The algorithm logic for the different delivery options in the plugin is as follows:

1. Is HTTP enabled? If yes, send a report over HTTP, regardless of its status (simulation or real)
2. Is SMTP enabled? If no, stop, otherwise go to next
3. Is "Never report phishing simulations (Suppress SMTP)" enabled AND this is a simulation email? If BOTH are yes, then stop, otherwise go next
4. Send report over SMTP

For more clarification of various use cases of the plugin configuration please refer to the examples here.

Known Issues: if you use SMTP for receiving incident reports on Lucy within the incidents, Lucy will intercept all your emails to the domain specified. If you use example.com as a domain for receiving the incidents in LUCY, the internal Postfix server will be listening for this domain for incoming mails. If you now start at the same time a phishing or awareness campaign and try to send your emails to "@example.com", LUCY will not forward those emails externally.

Phishing Incident Reports created by users are collected in the Incidents section.

• Dashboard Filter: LUCY allows you to filter the incoming mails on the dashboard:

• Centralized Analysis: This feature allows you to analyse the incoming mails manually or automatically
• Centralized Campaign Reporting: Any reported mail which is part of a phishing simulation will be processed within the campaign statistics
• Threat Mitigation: The Threat Mitigation allows you to take actions against legitimate phishing attacks
• Custom Regex & Score: LUCY allows you to define custom rules to scan mails for specific keywords and flag them with a individual threat score.

The plugin automatically handles emails created in a phishing simulations from LUCY: it will ensure that only reports of potentially malicious emails are delivered to appropriate security staff. All emails created by LUCY itself will create a custom message to inform the user, that the mail has been send as a part of a security awareness program. LUCY generated phishing mails won't be forwarded to the security team. But they will be reported back to LUCY in order to process the information within the campaign statistics. The reported mails will then be purged from the successful attack listings in LUCY.

If a user spots the phishing simulation and reports the email, you can see this information in various places:

• Incident widget on the dashboard:

• Incident tab:

• Under the campaign statistics (recipients) under the "reported" item:

• If you want a comparison of all reported emails, you can export the whole campaign data via CSV. Within the CSV there is a reported column:

The incidents reports will also be integrated on the dashboard under the general statistics.

For more detailed information on the report's analysis please proceed to Centralized Analysis.

The threat mitigation allows a LUCY admin to report reported phishing mails to according abuse contact of the provider's originating IP address taken from the message header. You can click on the mail symbol within the incident center to initiate the sending of the report. More info here.

The e-mails reported to LUCY via plugin can be automatically forwarded to external systems (e.g. Splunk) via LUCY's REST API. This ensures a seamless connectivity to a SOC.

The plugin is a non signed MSI file and programmed as a C++/COM object. It is bundled with Microsoft Visual C++ 2015 Redistributable (x86) Package (14.0.23026). The loading time of the plugin is around 10 MS. It has been tested in 2016 and 2019. An Office365 and Gmail Plugins are also available.

A phishing mail generated in LUCY will have a "X-Lucy-VictimUrl" value in the mail Header. This allows LUCY to identify the phishing mail and Report it back to the app using a HTTPS call. Example:

X-Lucy-VictimUrl: https://microsoft.secure-log-in365.info/f56/phishing-report Message-Id: 20170414072426.390935E2095F@demo.phishing-test.services

If the user clicks the phish button where the HTTP delievery is configured in the Settings, a new click Event is generated. The variables could look like this:

  url: https://demo.phishing-test.services/phishing-report 
  email: test@lucysecurity.com
  message: Thanks. Your help is appreciated!
  lucyMessage: This was a phishing simulation. Thank you for your help!
  buttonText: Phish Reporter
  submitHttp: yes
  submitSmtp: yes
  something is selected
  user clicked yes
  property accessor is ok
  submitting over smtp...
  successfully submitted over smtp
  submitting over http...
      url: https://microsoft.secure-log-in365.info/f56/phishing-report

HTTPS communication - plugin to LUCY: The XML always uses web browser to send data to Lucy. In case of running as a web-plugin in MS Outlook it uses the build-in web browser (for Windows it is Internet Explorer) to communicate with Lucy. Both, MSI and XML, use the proxy system settings (Windows > Control Panel > Network and Internet > Internet Options). If Windows-based authentication is required for the proxy, it will work transparently as well as for MSI and XML.

There is a possibility to use your own plugin to report emails to LUCY. To do this you need:

1. Configure your domain that is used for LUCY so that its MX records might point to LUCY
2. Configure an email address for receiving incident reports in Settings - Incidents Settings - Plugin Settings, this email address should use the domain configured on step 1.
3. Turn on check-boxes "Send Reports Over SMTP" and "Use SMTP for receiving incident reports on LUCY"

After these steps are done you can forward any email as an attachment to the configured email address and LUCY will treat these emails as incident reports and display them on the "Incidents" page.

If you enable "send reports via SMTP" you cannot send emails to the same domain (e.g. "example.com") anymore: this setting will cause Lucy to intercept all your emails to "example.com" domain. If you remove the checkbox, then Lucy won't try to intercept emails for that domain and the feature will work as expected. Using "Send Reports Over SMTP" along with "Use SMTP for receiving incident reports on Lucy" is the other way to deliver phishing reports to Lucy. You can specify, for example, some custom email like lucy-phishing-reports@separatedomain.com as a primary email in Incidents settings, check both those checkboxes and point separatedomain.com MX records to Lucy. So all emails being sent to lucy-phishing-reports@separatedomain.com will be intercepted by Lucy, as well as emails sent from Outlook plugin - they will be added to the "Incidents" page. If you just want to receive a copy of incident report to your own email (yourname@example.com), that is not tied to Lucy, then you should keep "Use SMTP for receiving incident reports on Lucy" checkbox clear - in that case Lucy won't attempt to intercept anything and the plugin will just forward all reports to yourname@example.com.