Phishing protection problems

[DougM 0]

We are getting phishing emails for Office365 credentials that make it through the ECOS filter. I've chatted with helpdesk and they had me submit samples to samples@eset.com  My question is "How does the filter check for phishing?" These emails were blatantly phishing emails. I've seen other emails where the creators were creative and made it past the filter but these were obvious.

Are they only checked by known sender?

Is the content of the email not checked?

Just curious.

[Marcos 5,074]

Would it be possible to get those in the msg or eml format? Emails are analyzed complexly by antispam protection, it's not just the sender or the content of the email that is important for being recognized as spam.

[DougM 0]

9 hours ago, Marcos said:

Would it be possible to get those in the msg or eml format? Emails are analyzed complexly by antispam protection, it's not just the sender or the content of the email that is important for being recognized as spam.

Sent. Thanks.

[DougM 0]

Does anyone monitor the samples@eset.com ? Should I be sending anything I come across or does someone only monitor it if they requested someone to send a sample? I just don't want to send items there if it's not going to do any good.

[Marcos 5,074]

I see 3 tickets from your email address there, all were processed and urls were blocked.

If you want to report an undetected spam, follow the instructions at https://support.eset.com/en/kb141:

If you are using ESET Cloud Office Security, use dedicated email addresses nospam_ecos[at]eset.com and spam_ecos[at]eset.com to report false positive (FP) / false negative (FN) detections for spam. For detailed instructions, see ECOS Online Help.