How to Create a Content Policy to Prevent Employee Impersonation

Last updated on 2021-11-16 16:52:15

These instructions apply to customers not currently using Microsoft 365. If you are using Microsoft 365, contact your sales representative to discuss Impersonation Protection.

Employee impersonation is one of many sophisticated email threats organizations encounter. Employee impersonation attacks occur in many different ways, one of the most common being display name spoofing. Display name spoofing attacks attempt to deceive recipients by changing the display name of their email to impersonate an employee. These emails typically come from legitimate email accounts, such as Gmail or Yahoo, and do not contain any links or attachments. They are designed using social engineering.

To protect against these attacks, you should use a combination of gateway defenses with an API based inbox defense, which uses AI to analyze historical email information to stop sophisticated email threats from reaching your users’ inboxes, along with user awareness training. If you are unable to use inbox defense, you can create content policies at the gateway to block unwanted emails.

While content filtering is not foolproof, they do provide a greater level of control than that of unrestricted content.

To create a content policy:

Log into Email Gateway Defense and go to the Inbound Settings > Content Policies page.
Under Message Content Filter section, type in the name of the employee for the Pattern.
Select Block for the Action.
Select Sender for the Match.
Click Add.

For example, if you want to block display name spoofing attacks for your CEO "Hank Eckerson", your inbound content policy would be similar to this.

Note that these policies will block ALL inbound mail that contain that specific pattern. If an email is received from someone who has the same name, their mail will also be blocked. To allow an external email that has the same display name as a protected employee, you must create an IP or sender based exemption.