Detection catalogue

Explore published rules with transparent provenance, licensing, and ATT&CK mappings.

detections

Loading detections…

Abnormal Security - User-reported email campaigns

Groups user-reported Abuse Mailbox submissions by campaign to show which reported campaigns affected the most recipients. Useful to gauge the spread of a phishing campaign that employees flagged.

ATT&CK coverage

Outside the enterprise matrix

T1566Phishing 159 detections cover this technique

Detection requirements

Log source product: abnormalsecuritypush
Log source service: abnormal_security_abuse_mailbox_cl

What the source says

Tagged by the source as

InitialAccess

Detection logic

Published to signed-in readers

The query as its source wrote it, its canonical form, and the content hash that pins this exact revision.