<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
---
name: conducting-phishing-simulations
description: >-
  Design and execute phishing simulation campaigns using GoPhish and similar
  frameworks. Covers campaign planning, pretext design, landing page creation,
  metric collection, repeat-clicker remediation, and compliance reporting.
domain: cybersecurity
subdomain: phishing-defense
tags:
  - phishing-simulation
  - gophish
  - security-awareness
  - social-engineering
  - campaign-metrics
  - user-training
version: "1.0"
author: defconxt
license: AGPL-3.0
metadata:
  mitre-attack: ["T1566.001"]
---

# Conducting Phishing Simulations

## Overview

Phishing simulations measure organizational susceptibility and reinforce security
awareness training. This skill covers the full campaign lifecycle: pretext design,
target group management, landing page creation, email template authoring, campaign
execution, metric collection, and remediation workflows for repeat offenders.

## Prerequisites

| Requirement | Install |
|---|---|
| GoPhish | `docker run -d -p 3333:3333 -p 8080:8080 gophish/gophish` |
| Python 3.10+ | Agent tooling runtime |
| SMTP relay | Configured sending profile |
| DNS | Simulation domain with SPF/DKIM |
| Management approval | Written authorization before campaign |

## Key Concepts

### Campaign Metrics

| Metric | Target | Description |
|---|---|---|
| Email open rate | Tracking only | Percentage who opened the email |
| Click rate | < 5% | Percentage who clicked the link |
| Credential submission | < 2% | Percentage who entered credentials |
| Report rate | > 60% | Percentage who reported via phish button |
| Time to first report | < 5 min | Speed of first user report |
| Repeat clickers | 0 (3+ campaigns) | Users failing multiple campaigns |

### Pretext Categories

```
Difficulty Tiers (rotate across campaigns):
├── Tier 1 — Easy (baseline)
│   ├── "Your password expires in 24 hours"
│   ├── "IT system maintenance — verify your account"
│   └── "Failed delivery notification"
├── Tier 2 — Medium
│   ├── "Shared document from [colleague name]"
│   ├── "Invoice #INV-2026-0142 attached"
│   └── "Benefits enrollment deadline tomorrow"
├── Tier 3 — Hard (targeted)
│   ├── "CEO requests urgent wire transfer" (BEC sim)
│   ├── "Board meeting agenda — confidential"
│   └── "LinkedIn connection request from [recruiter]"
└── Tier 4 — Advanced (AI-enhanced)
    ├── Personalized from LinkedIn/social data
    ├── Thread hijack simulation
    └── QR code or MFA fatigue pretext
```

### GoPhish Architecture

```
GoPhish Server (port 3333 admin, 8080 phish)
├── Sending Profiles → SMTP relay configuration
├── Landing Pages → Credential capture pages
├── Email Templates → Phishing email content
├── User Groups → Target employee lists
└── Campaigns → Combine all components, schedule launch
```

## Workflow

### 1. Campaign Planning

```bash
# Generate campaign plan with agent
node agent.js plan --tier 2 --targets 500 --duration 72h

# GoPhish API: create sending profile
curl -k -X POST https://localhost:3333/api/smtp/ \
  -H "Authorization: Bearer ${GOPHISH_API_KEY}" \
  -H "Content-Type: application/json" \
  -d '{"name":"sim-profile","host":"smtp.relay.com:587","from_address":"it-support@sim-domain.com","username":"user","password":"pass"}'
```

### 2. Target Management

```bash
# Import target CSV (Name, Email, Position)
# GoPhish API: create user group
curl -k -X POST https://localhost:3333/api/groups/ \
  -H "Authorization: Bearer ${GOPHISH_API_KEY}" \
  -H "Content-Type: application/json" \
  -d '{"name":"Q1-2026-All-Staff","targets":[{"first_name":"Jane","last_name":"Doe","email":"jane@company.com","position":"Engineer"}]}'

# Generate target list from HR export
node agent.js import-targets /tmp/employees.csv
```

### 3. Launch and Monitor

```bash
# Create and launch campaign via API
curl -k -X POST https://localhost:3333/api/campaigns/ \
  -H "Authorization: Bearer ${GOPHISH_API_KEY}" \
  -H "Content-Type: application/json" \
  -d '{"name":"Q1-2026-Tier2","template":{"name":"shared-doc"},"page":{"name":"o365-login"},"smtp":{"name":"sim-profile"},"groups":[{"name":"Q1-2026-All-Staff"}],"launch_date":"2026-03-20T09:00:00Z","send_by_date":"2026-03-20T12:00:00Z"}'

# Monitor campaign progress
node agent.js monitor --campaign-id 1
```

### 4. Report Generation

```bash
# Generate campaign report
node agent.js report --campaign-id 1

# Export results for management
node agent.js export --campaign-id 1 --format csv
```

## Detection

```yaml
title: Phishing Simulations Detection
id: a33f46f8-c894-43b4-9347-afc064201508
status: experimental
description: Detects suspicious activity related to conducting phishing simulations techniques in phishing defense context
logsource:
  category: email
  service: o365
detection:
  selection:
    Subject: "*urgent*"
  condition: selection
level: high
tags:
  - attack.t1566.001
  - attack.initial_access
falsepositives:
  - Security awareness training platform sending simulated phishing emails
```

## Verification

| Check | Method |
|---|---|
| Authorization obtained | Written approval from management documented |
| Sending profile tested | Test email delivered successfully |
| Landing page functional | Credentials captured in test submission |
| Metrics collecting | Open, click, submit events logging |
| Report button working | Reported emails reach SOC inbox |
| Repeat clickers tracked | Multi-campaign comparison available |

## References

- [GoPhish Documentation](https://docs.getgophish.com/)
- [GoPhish API Reference](https://docs.getgophish.com/api-documentation/)
- [NIST SP 800-50 — Security Awareness Training](https://csrc.nist.gov/publications/detail/sp/800-50/final)
- [CIS Controls v8 — 14: Security Awareness Training](https://www.cisecurity.org/controls/v8)
