This discussion has been locked.

You can no longer post new replies to this discussion. If you have a question you can start a new discussion

VIP Impersonation requires an exact name match

I have started to see slightly more sophisticated phishing attempts that are bypassing Sophos VIP Impersonation.

Instead of the classic From: "CEO Name" [ceoname@fakedomain.com] which gets blocked because "CEO Name" matches, we are now seeing:

From: "CEO Name <ceoname@legitdomain.com>" [ceoname@fakedomain.com]. This is not getting blocked because the Name Header contains more than just the Name, and adding the legit domain email makes it appear more legit to users.

Can VIP Impersonation be changed to search for Name Headers that include a name from the VIP list, rather than an exact match? Or perhaps provide a switch for clients that want to enable this?

Thanks for listening

Added tags
[edited by: Raphael Alganes at 2:53 AM (GMT -7) on 7 Jun 2023]

Parents

0 emmosophos over 2 years ago

Hello Matt,

Thank you for contacting the Sophos Community.

I will be passing down your feedback to our PM about this.

Regards,

Emmanuel (EmmoSophos)

Technical Team Lead, Global Community Support
Sophos Support Videos | Product Documentation | @SophosSupport | Sign up for SMS Alerts
If a post solves your question use the 'Verify Answer' link.
Cancel
Vote Up 0 Vote Down

Cancel
0 Ian Hellier over 2 years ago in reply to emmosophos

What would actually be good is to use a percentage match on the domain side too. So when you have VIPName@slightlymisspeltcompanydomain.com it also flags it as potentially suspect. Seeing far too many of those these days too.
Cancel
Vote Up 0 Vote Down

Cancel

Reply

0 Ian Hellier over 2 years ago in reply to emmosophos

What would actually be good is to use a percentage match on the domain side too. So when you have VIPName@slightlymisspeltcompanydomain.com it also flags it as potentially suspect. Seeing far too many of those these days too.
Cancel
Vote Up 0 Vote Down

Cancel

Children

No Data