Fix Microsoft Attack Simulator Reporting Forwarded Emails as Successful Attacks
Question details
Users are encountering apparent false positives where Microsoft Attack Simulator logs a successful attack simply because a user forwarded the simulated phishing email.
- Product
- Microsoft Attack Simulator
- Device & OS
- not provided
- Scenario
- Administrators are reviewing the results of a simulated phishing campaign to evaluate user security awareness.
- Observed behavior
- The simulator marks a user as compromised (successful attack) when the message or attachment is forwarded, even if the user never directly opened or downloaded the payload.
Ensure you have Security Administrator or Global Administrator privileges in your Microsoft 365 tenant to access campaign reports, message traces, and to submit diagnostic data to Microsoft Support.
Collect Campaign Details and Contact Microsoft Support
Gather the necessary diagnostic data and submit it to Microsoft so the false positive forwarding behavior can be investigated and resolved.
Because Attack Simulator tracks payload interaction via embedded tokens, security scanners or link pre-fetching during the forwarding process may inadvertently trigger these tokens. Resolving this requires Microsoft support to analyze the specific campaign parameters and the recipient's forwarding mechanisms.
Navigate to the Microsoft 365 Defender portal and record the payload type, message format, and success criteria configured for your simulated campaign.
Use the Exchange admin center's message trace feature to document exactly when and how the email was forwarded, including recipient details and timestamps.
Take clear screenshots of the Attack Simulator campaign reports showing the false positive entries alongside the user names.
Open the 'Help & support' pane in the Microsoft 365 admin center, attach all collected logs, screenshots, and campaign details, and request a technical review of the false positive behavior.
Enhance Your Productivity Securely with WPS Office
While resolving administrative issues in Microsoft 365, consider equipping your team with WPS Office. It is a highly secure, lightweight, and free office suite that ensures smooth document processing without heavy system overhead.
- 1. Download the installer: Visit the official WPS Office website and click the free download button for your operating system.
- 2. Install the software: Run the downloaded installer file and follow the quick on-screen setup instructions.
- 3. Start creating documents: Open WPS Office to instantly view, edit, or create documents compatible with Microsoft Office formats.
Frequently Asked Questions
Why does Attack Simulator count a forwarded email as a compromise?
This happens when the email client's security scanners, antivirus software, or the forwarding server itself automatically pre-fetches links or scans attachments. The simulator interprets this automated interaction as the user clicking the payload.
Can I automatically exclude forwarded emails from campaign success metrics?
Currently, Microsoft Defender for Office 365 tracks direct interactions with the tracking token. If the token is triggered during forwarding, it is logged. You may need to manually filter these results or adjust payload settings with Microsoft Support.
What information does Microsoft need to fix false positives in Attack Simulator?
Microsoft requires your campaign configuration, the specific message and attachment types used, logs showing the forwarding behavior, recipient information, and screenshots of the campaign reports showing the discrepancy.
