schillings / swordphish Goto Github PK

Schillings SwordPhish empowers organisations and engages its employees to establish the key component of any cyber security strategy: the Human Firewall.

Home Page: https://cyber.schillingspartners.com

License: Apache License 2.0

C# 79.43% Smarty 20.57%

phishing cyber-security human-firewall

swordphish's Introduction

SwordPhish

At some point technology will fail and your users will be the last line of defence. SwordPhish allows users to easily report suspicious e-mails to your IT and security teams.

SwordPhish is a very simple but effective button that sits within the users Outlook toolbar. One click and the suspicious e-mail is instantly reported to your designated recipient (i.e your internal security team, or SoC) and contains all metadata required for investigation.

SwordPhish should be underpinned by a staff security awareness programme. Suspicious e-mails can't be reported if your users don't know what they are looking for or what is suspicious.

The recipient of a SwordPhish report receives the original e-mail as an attachment and every header to aid further investigation.

Requirements

SwordPhish requires Microsoft Office 2007+, .NET Framework 4.0+ and VTSO 4.0+ to be installed, and works across all Windows platforms.

Installation

The easiest way to install SwordPhish is via the pre-compiled MSI installers under the Releases tab. If you are an End User just run Schillings SwordPhish.exe. If you are a SysAdmin then you can use the MSI installers for your platform and push out via GPO.

If you are so inclined you can build SwordPhish from source. Simply clone this repository and compile with Visual Studio 2010+.

Deployment

You can deploy SwordPhish as you would any other application: manually, Group Policy, batch file at logon, or your favourite systems management solution.

Options

SwordPhish just needs to know where to send reports to. If you run the GUI installer you will be asked to supply these at installation.

If you are installing via CMDLINE/GPO you can set other options via the MSI installer or property flags:

Flag	Description
RECIPIENTPROPERTY	E-mail address where to send SwordPhish reports
SUBJECTPROPERTY	Subject of SwordPhish reports
ACTIONPROPERTY	What to do after a user reports an e-mail. 0 = Just send the report, 1 = Report and move the e-mail to "Junk", 2 = Report and delete the e-mail from the user's Inbox.

For example: msiexec /i Schillings.SwordPhish.x86.msi RECIPIENTPROPERTY="[email protected]" ACTIONPROPERTY=2

To make your life easier for reporting it is recommended to set the recipient address to a ticketing system.

License and Disclaimer

SwordPhish is licensed under Apache 2.0.

In no event and under no legal theory, whether in tort (including negligence), contract, or otherwise, unless required by applicable law (such as deliberate and grossly negligent acts) or agreed to in writing, shall any Contributor be liable to You for damages, including any direct, indirect, special, incidental, or consequential damages of any character arising as a result of the use or inability to use the Work (including but not limited to damages for loss of goodwill, work stoppage, computer failure or malfunction, or any and all other commercial damages or losses), even if such Contributor has been advised of the possibility of such damages.

swordphish's People

Contributors

Stargazers

Watchers

swordphish's Issues

Support Mac platform

Would require a rewrite using the JavaScript API - which also means we would be able to support Web clients.

Schillings.SwordPhish.v1.0.x86.msi not installing

Does not seem to install on Office 365 Business Version 1711 (Build 8730.2127 Click-to-Run)

Does not work on windows 10 and outlook 2016

I installed Schillings.SwordPhish.x64.msi and vstor_redist.exe but the app did not work, the icon did not appear in the outlook 2016

I can't enable the add-in in Outlook

Hi,
We have installed this add-in in our company, it gets install properly, but when you open Outlook it doesn't let you enable it. It comes up in the Add-in screen, you click in go, enable... but nothing happens.

Any idea? We are not missing any of the requirements. Framework and VSO are installed.

Thanks

Outlook Office 365, successfully installed, icon greyed out and not functional

Built and successfully installed the add-in using the MSI installer, but when using it with Outlook Office 365, the "Report as Phishing" button is greyed out and not functional. Anyone else ran into this?

Installed using:
msiexec /i Schillings.SwordPhish.installer.msi RECIPIENTPROPERTY="[email protected]" SUBJECTPROPERTY="Email Report" ACTIONPROPERTY=2

Windows 10, version 1803
Office365 Business, version 16.0.11231.20174

A confirmation dialog for reports

Just some feedback from our user base.

We have had a few false positives being reported because people are clicking the wrong button.
It would be handy to have a confirmation dialog pop up after clicking the submit button.

It's a nice to have for me, but users would probably celebrate.

64 bit Outlook - addin not working

Hi,

Thank you very much for the contribution. I have successfully installed it on windows 10/windows 7 machines running office 32 bit. Following the same steps and using the MSI, the add-in is not visible/installed on the 64bit outlook client. When clicking on the vsto file directly the add-in does install and become visible in the outlook bar, but it does not give the opportunity to report anything (not enabled???). Perhaps there is a registry setting missing for 64bit outlook clients?

Would you be able to point me in the right direction on how to install this on a 64-bit machine?

In advance many thanks!

How to compile .msi?

I need to change the swordphish icon for my company, but I'm not sure how to compile the .msi file. I loaded it into visual studio and I can compile the .dll, but I can't find a way to compile an .msi installer.

So then I installed wix and tried

candle Schillings.SwordPhish.Installer\Product.wxs
error CNDL0150 : Undefined preprocessor variable '$(var.Schillings.SwordPhish.TargetPath)'.

then I tried msbuild and I got the following error:

"C:\redacted\SwordPhish-master\Schillings.SwordPhish.Installer\Schillings.SwordPhish.Installer.wixproj" (default target) (1) ->
"C:\redacted\SwordPhish-master\Schillings.SwordPhish\Schillings.SwordPhish.csproj" (default target) (4) ->
  C:\redacted\SwordPhish-master\Schillings.SwordPhish\Schillings.SwordPhish.csproj(276,3): error MSB4019: The imported project "C:\Program Files (x86)\MSBuild\Microsoft\VisualStudio\v11.0\OfficeTools\Microsoft.VisualSt
udio.Tools.Office.targets" was not found. Confirm that the path in the <Import> declaration is correct, and that the file exists on disk.

I tried installing VSTO 2012, but it keeps saying visual studio is not installed, even though it obviously is.
Visual Studio Professional 2017

msiexec error

"This installation package could not be opened. Verify that the package exists and that you can access it, or contact the application vendor to verify that this is a valid Windows Installer package. "

I've used the following commands as admin, and they result in the same error:
msiexec /i Schillings.SwordPhish.Installer.msi RECIPIENTPROPERTY="[email protected]" ACTIONPROPERTY=2 msiexec /i .\Schillings.SwordPhish.v1.0.x86.msi RECIPIENTPROPERTY="[email protected]" SUBJECTPROPERTY="Phishing Report" ACTIONPROPERTY=1

However, I have been able to install it and use it using the GUI, so I know it works.

Having trouble building from source

Hey there! Awesome tool!

I'm having trouble getting a self-built version to do anything once installed.

Dev machine: VS2019+VSTO+wix311+Wix VS plugin+Win10x64
Guest machine: VSTO+O365+Win10x64

On install of my locally built copy, O365 does not get an icon at all. If I install the github compiled MSI it works correctly.

VS release build output produces the file 'Schillings.SwordPhish.Installer' and there's no x64 architecture build options present in the VS build config. Comparatively, the github releases are architecture specific.

This may be related to #5 - perhaps architecture/build updates haven't been pushed to git?