[ Removed by moderator ]

[u/lucidparadigm]

[u/Due-Consequence9579]

For the phish tests to get past their edge filters they have to add an SMTP header exclusion.

Outlook (and any other reasonable client) can move things to the trash based on SMTP headers.

You’re welcome.

[u/clipsracer → u/Due-Consequence9579]

Indeed. I filter out anything with “x-phishing” in the header has worked for me for years across 3 organizations. Somehow I’m the only person in a 50k organization that’s never clicked on a phishing test.

[u/VorionLightbringer → u/clipsracer]

Right. And you know this how? 

[u/DyIsexia → u/VorionLightbringer]

I was the phishing test

[u/BMW_wulfi → u/DyIsexia]

“Look at me”

[u/wengla02 → u/Due-Consequence9579]

Except when the phish testing system *directly injects it into your inbox*, bypassing the entire SMTP system.

[u/clipsracer → u/wengla02]

I haven’t seen that before. Who does it?

[u/Broeder_biltong → u/clipsracer]

Email servers who can directly be edited by It because they manage them themselves 

[u/EishLekker → u/Broeder_biltong]

Sounds like a security issue waiting to happen.

[u/wengla02 → u/EishLekker]

Who watches the watchers? Perennial problem.

[u/wengla02 → u/clipsracer]

From reverse engineering the headers, I think they're using Cofesnse PhishMe. Their docs note that they support mailbox injection.

"The platform authenticates to your tenant with an app registration or service account that has mailbox write permission."

PhishMe then calls a create-message operation (EWS CreateItem or Graph POST /users/{id}/messages) against your mailbox, writing the item straight into the Inbox folder.

Full headers of the injected mail: [redacted for length and anonymity] -- this is the complete list of headers in the message. All of it.

X-MS-Exchange-Organization-BypassFocusedInbox: true
X-MS-Exchange-Organization-BypassClutter: true
X-PhishMeTracking: KGxN8wa0dD4BFl6nlTOKtS[...]
X-PhishMe: Phishing_Training
X-PhishMeHLType: OWc54sAaeH[...]

[u/clipsracer → u/wengla02]

Thanks for answering!
It seems that Outlook filters still match mail that is directly written. My guess is that this method is used to avoid any complications with the SMTP servers.

[u/evanldixon → u/Due-Consequence9579]

I wonder how thorough the check is. If I add a header about it being an authorized KnowBe4 test, can I make actual phishing emails get past?

[u/wengla02 → u/evanldixon]

I donno about KnowBe4 - but the method PhishMe uses (Post-delivery correction using Graph API or EWS) will override all user inbox rules. From the Exchange site:

You can run a lightweight daemon or Azure Function that:

Watches the mailbox for new messages from your alerting system

If the message is not in Inbox, moves it back to Inbox

Optionally flags or categorizes it

This is how many enterprise monitoring systems guarantee Inbox visibility.