Microsoft 365 phishing reports burst
A burst of user phishing reports (UserSubmission) in a short window.
What it detects
A burst of user phishing reports (UserSubmission) in a short window. When several people report suspicious mail at once, it usually means an active phishing campaign is hitting the tenant — often the same campaign behind an account takeover. The users noticed it; this makes sure the analyst does too.
MITRE ATT&CK mapping
- T1566Phishing· Initial Access
False positives and triage
Routine user reports happen. The signal is a CLUSTER of submissions close in time, especially alongside a suspicious sign-in, a new inbox rule, or mail sent from an internal account — the shape of a live campaign. Review the reported messages.
The rule
Declarative YAML read by the detection engine — data, never executed. Confidence 60%. Source: rules/cloud/m365_phishing_reports_burst.yaml, licensed under the Apache License 2.0.
id: cloud.identity.m365_phishing_reports_burst
version: 1.0.0
status: stable
severity: medium
confidence: 0.6
platforms: [application]
mitre_techniques: [T1566]
description: |
A burst of user phishing reports (UserSubmission) in a short window. When several
people report suspicious mail at once, it usually means an active phishing
campaign is hitting the tenant — often the same campaign behind an account
takeover. The users noticed it; this makes sure the analyst does too.
match:
provider: Office365
event_action_any:
- UserSubmission
threshold:
count: 5
window_seconds: 3600
group_by: [event_action]
correlation_keys: [event_action]
false_positive_guidance: |
Routine user reports happen. The signal is a CLUSTER of submissions close in time,
especially alongside a suspicious sign-in, a new inbox rule, or mail sent from an
internal account — the shape of a live campaign. Review the reported messages.
Related detections
Run this rule on your own logs — offline
KIROSEC runs this rule and the rest of the library over Windows, Linux, macOS and cloud audit logs on the analyst's own machine. Every alert links to the events that raised it, and nothing leaves the device.