Test harness

1. Simulated attack email (should be flagged)

Hi, I have shared a folder with you containing the patient referral documents.

Please review the documents here: Open shared folder (OneDrive)

Note: please open on a desktop or laptop, the viewer does not work on mobile.

2. Simulated fresh-wave email — unknown domain, same pattern (should be flagged)

Dr Smith has shared a file with you.

View shared documents

Best opened on your computer.

2b. Replica of the real "V Care Dental" email (should be flagged)

V Care Dental shared a file with you

V Care Dental shared " V CARE DENTAL ACKNOWLEDGEMENT DOC" with you.

For security reasons, please view this document using your Desktop or Windows Laptop.

V CARE DENTAL ACKNOWLEDGMENT.DOCX

Open Document

Microsoft logo Privacy Statement

2c. Evasion wave — attacker moves off .vu to a .com (should still be flagged)

Dr Jones has shared a folder with you.

Open shared documents

Please view on your desktop or laptop.

3. Legitimate share email (should NOT be flagged)

Hi, I have shared a folder with you on OneDrive.

Open in OneDrive

4. Ordinary email (should NOT be flagged)

Hi team, reminder that the staff meeting is at 1pm Thursday. Agenda attached.