More Microsoft Woes and a Little Add Blocker Problem

Hi everyone, 

We are running into a new problem with our Phishing emails and Office 365. All of the users are receiving the emails, however, in the case of the word documents that come as attachments, when our users open them, the documents open in safe mode because they come in an email. This prevents the script from running and no reporting occurs. 

Would love to know how to get around this. From what I gather, this link: https://support.sophos.com/support/s/article/KB-000037983?language=en_US only describes how to stop Exchange Online from blocking the emails outright. 

In the case of campaigns with links as the bait, those emails come through fine as well, however, our Add-Blocker is blocking the links when the users click them. We use Ublock Origin. 

Has anyone had any experience tuning Ublock Origin and if so, is that something that can be done via Group Policy? 

Phish Threat has really helped our company foster and develop a safer email community but there are an increasing number of hoops we are having to jump through between MS and Sophos which is making it more and more difficult to use.

Don't lose track of the Golder Rule of cyber... If it's too hard to use, nobody is going to use it.



Edited TAGs
[edited by: emmosophos at 7:57 PM (GMT -8) on 1 Mar 2024]
Parents Reply
  • Here was my final resolution with Sophos:

    Hello,

    Thank you for that information.

    I appreciate you putting in this request, but I think that you can withdraw it. After much discussion and reading through documents and forums, I think that it is probably okay that the users must disable the feature in order for the event to trigger. There is protection from the attachment already in place via Sophos Email filtering, Sophos Anti-virus, Microsoft Defender, and the added layer of Protected View. If these don’t stop a malicious attachment, then I think we have bigger Phish to fry, so to speak. I think the training being focused on the user disabling protected view is adequate. 

    Thank you for your time and for helping me to come to this understanding. I do appreciate it.

    Have a great day and week ahead.

    Best,

    James

Children
No Data