u/nocryptios

We’re running KnowBe4 phishing simulations in a Microsoft 365 and Defender environment, and have configured Advanced Delivery Policies as recommended by KnowBe4. The emails are being delivered but we’re still seeing MDE detect and quarantine some simulated attachments, specifically .xlsm files.

Example event: OUTLOOK.EXE created file Invoice.xlsm

Path: C:\Users\<user>\AppData\Local\Microsoft\Windows\INetCache\Content.Outlook\<folder>\Invoice.xlsm

Defender finds: TrojanDownloader:O97M/Obfuse.SU!MTB inside Invoice.xlsm->xl/vbaProject.bin

Defender also finds: Trojan:O97M/Phish.RV!MTB inside Invoice.xlsm->xl/drawings/_rels/drawing1.xml.rels

The remediation action is successful quarantine and in some cases the alert says it prevented attempted open by OUTLOOK.EXE.

My understanding is that Advanced Delivery helps Microsoft 365 Defender for Office identify authorised phishing simulations and bypass certain mail filtering and detonation behaviour but it does not necessarily stop Defender MDE from scanning and quarantining the file once Outlook writes it to the cache locally. So this appears to be endpoint protection detecting the simulated payload rather than Microsoft 365 blocking delivery.

Has anyone else run into this with KnowBe4 .xlsm or macro-enabled phishing simulation attachments? This has been ongoing for about 6 months where Microsoft and KB4 are of little help. This is also having a minor impact to our phishing test reports where users that interact with xlsm payload tests are not marked as a fail.

The only option I see to stop these detections would be to whitelist payload behaviour that the phishing tests are there to prevent which feels dumb.

I’m playing a Machine Empire and took the Uncanny trait and the early game has been weirdly hostile.

Old reddit posts claim (~5 years ago) that Uncanny had some opinion penalty but the current wiki only lists it as an influential jobs penalty with no opinion modifier. Do my machine leaders count as influential jobs and thus receive an empire opinion penalty?

For some reason I had always assumed resettlement was the “pick the planet you want to move pops away from then choose where they go” system. I'm likely very late to the party here however I've been handling pop migration by scrolling through my planet list, identifying planets with surplus pops then scrolling again to find the planet I want to migrate them to. I've wasted my last several games doing the former, paused for 20 minutes every 5 years or so to resettle and found this to be a chore. I hope I'm not the only one.