## 3 Methodology
### Attack Simulation and E-Learning Environment Description  
The phishing simulation was executed utilizing the Microsoft Defender for Office 365 platform, as outlined in official Microsoft documentation. This platform is specifically designed to provide extensive protection against sophisticated cyber threats, including phishing, ransomware, and related cyberattacks. This advanced tool enables organizations to conduct realistic phishing simulations and deliver targeted educational content, thereby enhancing employee skills in identifying and mitigating phishing threats. The license granted for this study allowed complete access to all essential functionalities needed to create realistic phishing scenarios. Mastery of each simulation configuration tool was crucial for precisely executing these simulations. The simulation parameters were based on social engineering techniques from the MITRE ATT&CK framework, a widely acknowledged repository of cyber adversaries' tactics, methods, and procedures (TTPs). This framework relies on empirical observations and serves as a definitive knowledge repository for constructing resilient threat models and strategic defense strategies, enabling organizations to effectively prevent, detect, and respond to cyber incidents. Phishing attack simulations in Microsoft Defender can be customized to meet goals. Seven distinct scenario types were present: credential harvesting (theft of usernames and passwords), malicious email attachments, links within email attachments leading to harmful content, links in the email body directing to malicious content, links to compromised but legitimate websites, launching Azure-based applications seeking unauthorized data access, and instructional scenarios for reporting phishing attempts. Content creation is essential for the authenticity and efficacy of simulations. Microsoft Defender offers a range of predefined templates, each tailored for specific scenarios, that users can examine and select as appropriate. The platform also facilitates the creation of tailored content, which requires intricate manual configuration of specific attack parameters. Phishing emails must meet several criteria, including defining the sender's identity, specifying the email source address, customizing the subject line, tailoring linguistic elements to recipient demographics, and embedding phishing links. Email content can be manually created, selected from pre-designed templates, or tailored through direct HTML editing, providing detailed personalization options. A crucial component of the simulation entails the deliberate selection of user groups. Participant selection may be entered manually or imported in bulk via a.csv file. Integration with Azure Active Directory (Azure AD) guarantees email authenticity and limits access to verified organizational accounts. Filtering criteria encompass departmental affiliation, geographic location, or other specified parameters. Furthermore, a thorough organizational simulation is achievable, with options for selective exclusion if required. Complementary cybersecurity education was provided via the Moodle LMS platform, an open-source system that offers comprehensive tools for creating, managing, and delivering customized educational content. Moodle's flexibility and advanced administrative features facilitated the delivery of tailored educational experiences that closely matched organizational needs. The educational content employed in Moodle was created using the Articulate 360 platform, particularly through the Rise 360 authoring tool. Moodle offers inherent content creation features; however, Articulate 360's suite provides superior interactive elements, such as simulations, quizzes, and gamified components, which markedly improve learner engagement. The Articulate platform is user-friendly, facilitating swift content creation without extensive technical knowledge and automatically optimizing content for various device formats, including desktops, tablets, and smartphones.