Catalogue
ATT&CK

Detection catalogue

Explore published rules with transparent provenance, licensing, and ATT&CK mappings.

detections

Search detections

Filters

Loading detections…

Loading detections

The public catalogue of detection rules. Every entry carries its source, the identifier it had there, its licence and its ATT&CK mapping.

Product

Catalogue ATT&CK Create a workspace

Trust

Security Privacy Licences Terms

Contact

Report a vulnerability Report a content issue contacto@detections.app

Medium>Splunk security content

O365 Email Reported By User Found Malicious

The following analytic detects when an email submitted to Microsoft using the built-in report button in Outlook is found to be malicious. This capability is an enhanced protection feature that can be used within o365 tenants by users to report potentially malicious emails. This correlation looks for any submission that returns a Phish or Malware verdict upon submission.

ATT&CK coverage

Initial Access

T1566Phishing
- T1566.001Spearphishing Attachment 74 detections cover this technique
- T1566.002Spearphishing Link 47 detections cover this technique

Detection requirements

Log source category: office_365_universal_audit_log

Detection logic

Published to signed-in readers

The query as its source wrote it, its canonical form, and the content hash that pins this exact revision.

Provenance

Where this detection came from, and what you may do with it.

At source: Open at source
Written by: Steven Dick
Licence: Apache-2.0Read the licence
Published: Aug 26, 2026
Version: 1