# Set-ExecutionPolicy -ExecutionPolicy RemoteSigned -Scope CurrentUser # Install-Module Microsoft.Graph -Scope CurrentUser # Connect-MgGraph -Scope "Mail.Send","Mail.Read","Mail.ReadWrite","MailboxSettings.ReadWrite","Directory.ReadWrite.All","Directory.Read.All","AttackSimulation.Read.All","AttackSimulation.ReadWrite.All" # Uncomment above commands if its 1st time running graph powershell SDK Import-Module Microsoft.Graph.Security $params = @{ displayName = "graph-powershell-submit" "payload@odata.bind" = "https://graph.microsoft.com/v1.0/security/attacksimulation/payloads('d8bb6432-6b28-49e2-b3a1-5ec9aa703f9c')" "loginPage@odata.bind" = "https://graph.microsoft.com/v1.0/security/attacksimulation/loginPages('9d85765f-5abc-403d-9edb-433f57eeed71')" "landingPage@odata.bind" = "https://graph.microsoft.com/v1.0/security/attacksimulation/landingPages('1cdfcb49-1065-46a6-b1c3-672071e20a6b')" createdBy = @{ email = "john@contoso.com" } durationInDays = "3" attackTechnique = "credentialHarvesting" status = "scheduled" includedAccountTarget = @{ "@odata.type" = "#microsoft.graph.addressBookAccountTargetContent" type = "addressBook" accountTargetEmails = @( "admin@testimcan.onmicrosoft.com" ) } trainingSetting = @{ settingType = "noTraining" } endUserNotificationSetting = @{ notificationPreference = "microsoft" settingType = "noTraining" positiveReinforcement = @{ deliveryPreference = "deliverAfterCampaignEnd" "endUserNotification@odata.bind" = "https://graph.microsoft.com/v1.0/security/attacksimulation/endUserNotifications('39f2c7bb-0df5-44be-9c6b-e30403c0b845')" defaultLanguage = "en" } simulationNotification = @{ targettedUserType = "compromised" "endUserNotification@odata.bind" = "https://graph.microsoft.com/v1.0/security/attacksimulation/endUserNotifications('b1290929-bcbf-4c91-a7d9-0714cd0d7054')" defaultLanguage = "en" } } } New-MgSecurityAttackSimulation -BodyParameter $params