Detection rules › Splunk

Windows Mail Protocol In Non-Common Process Path

Author
Teoderick Contreras, Splunk
Source
upstream

The following analytic detects a Windows application establishing an SMTP connection from a non-common installation path. It leverages Sysmon EventCode 3 to identify processes not typically associated with email clients (e.g., Thunderbird, Outlook) making SMTP connections. This activity is significant as adversaries, including malware like AgentTesla, use such connections for Command and Control (C2) communication to exfiltrate stolen data. If confirmed malicious, this behavior could lead to unauthorized data exfiltration, including sensitive information like desktop screenshots, browser data, and system details, compromising the affected host.

MITRE ATT&CK coverage

TacticTechniques
Command & ControlT1071.003 Application Layer Protocol: Mail Protocols

Event coverage

ProviderEvent IDTitle
Sysmon3Network connection

Stages and Predicates

Stage 1: search

search (DestinationPort IN (25, 587) OR DestinationPortName="smtp") NOT Image IN ("C:\\Program Files \(x86\)\\*", "C:\\Program Files\\*", "C:\\Windows\\SysWOW64\\*", "C:\\Windows\\System32\\*") EventCode=3

Stage 2: stats

stats BY action, app, dest, dest_ip, dest_port, direction, dvc, protocol, protocol_version, src, src_ip, src_port, transport, user, vendor_product, process_name, process_exec, process_guid, process_id

Stage 3: search

search

Stage 4: search

search

Stage 5: search

search `macro`

Exclusions

Top-level NOT(...) conjuncts — predicates this rule actively suppresses.

StageFieldKindExcluded values
1Imagein"C:\\Program Files \(x86\)\\*", "C:\\Program Files\\*", "C:\\Windows\\SysWOW64\\*", "C:\\Windows\\System32\\*"

Indicators

Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.

FieldKindValues
DestinationPortin
  • 25
  • 587
DestinationPortNameeq
  • "smtp"
EventCodeeq
  • 3 corpus 4 (splunk 4)