Suspicious Outbound SMTP Connections
Last updated on:
In this page
About the rule
Rule Type
Standard
Rule Description
Adversaries may steal data by exfiltrating it over an un-encrypted network protocol other than that of the existing command and control channel. The data may also be sent to an alternate network location from the main command and control server.
Severity
Trouble
Rule Requirement
Criteria
Action1: actionname = "sa_network_connection" AND (DEST_PORT = "25,587,465,2525" AND IS_INITIATED = "true") AND (PROCESSNAME notendswith "\thunderbird.exe,\outlook.exe" AND PROCESSNAME notstartswith "C:\Program Files\Microsoft\Exchange Server" AND (PROCESSNAME notstartswith "C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_" OR PROCESSNAME notendswith "\HxTsr.exe")) select Action1.HOSTNAME,Action1.MESSAGE,Action1.USERNAME,Action1.PROCESSNAME,Action1.DESTINATIONHOST,Action1.DESTINATION_IPV6,Action1.DEST_IP,Action1.SOURCEHOST,Action1.SOURCE_IP,Action1.SOURCE_IPV6
Detection
Execution Mode
realtime
Log Sources
Windows
Author
frack113
