AN0379
Analytic 0379
Windows
Detects unauthorized use of SMTP/IMAP/POP3 by suspicious binaries (e.g., PowerShell, rundll32) to exfiltrate data or beacon via email, often bypassing proxy or content filters.
WinEventLog:Sysmon
EventCode=3, 22
WinEventLog:Sysmon
EventCode=1
NSM:Flow
smtp.log
[ProcessImageName]
Limit to uncommon clients (e.g., scripts or CLI tools using .NET SMTP libraries)
[DestPortFilter]
Typically 25, 587, 993, 995, or 465 – flag anomalies
[AttachmentType]
Flag suspicious attachments (e.g., .zip, .7z, .bin)
AN0380
Analytic 0380
Linux
Detects non-interactive or script-driven email transmission using tools like `sendmail`, `mailx`, or custom SMTP scripts by background processes, especially when sending attachments or large payloads.
auditd:SYSCALL
execve
NSM:Flow
smtp.log, conn.log
[TransferSizeThreshold]
Bytes transferred via SMTP session
[ScriptNameFilter]
e.g., base64 encoded mailer scripts or one-liners in cron
AN0381
Analytic 0381
macOS
Detects email-sending behavior via Terminal, AppleScript, or Automator that interfaces with SMTP or IMAP, typically using curl or mail-related APIs in unsanctioned contexts.
macos:unifiedlog
log stream --predicate 'processImagePath CONTAINS "curl" OR "osascript"'
macos:osquery
socket_events
[UserContext]
Monitor non-mail client users initiating SMTP/IMAP
[TimeWindow]
Look for execution of mail commands during off-hours
AN0382
Analytic 0382
Network Devices
Detects hosts transmitting large volumes of SMTP, IMAP, or POP3 traffic to external IPs or relays that aren't associated with the enterprise mail infrastructure.
NSM:Flow
smtp.log, conn.log
[ExternalMailRelayFilter]
Dest IPs not matching sanctioned SMTP/IMAP relays
[OutflowToInflowRatio]
Outbound email bytes vastly exceed response