{"id":"0f9486c4-2270-4a13-9bd8-f37d3017f7b7","title":"Non-Mail Client IMAP Connection Hunt Starter","description":"Detects non-mail-client processes establishing outbound IMAP or IMAPS connections. This is a behavior-level hunt for IMAPLoader-style command and control associated with Imperial Kitten / Yellow Liderc reporting. Tune approved automation and legacy mail clients before alerting; this selector is intentionally broad.\n","author":"Andrey Pautov","status":"experimental","level":"low","date":"2026-05-14","modified":"","tags":["attack.command-and-control","attack.t1071.003"],"technique_ids":["T1071.003"],"logsource":{"product":"windows","category":"network_connection"},"falsepositives":["Approved mail clients not included in the local allowlist.","Legacy mail-collection scripts or monitoring agents that use IMAP."],"references":["https://www.crowdstrike.com/en-us/blog/imperial-kitten-deploys-novel-malware-families/","https://www.pwc.com/gx/en/issues/cybersecurity/cyber-threat-intelligence/yellow-liderc-ships-its-scripts-delivers-imaploader-malware.html"],"source_path":"rules/windows/network_connection/net_connection_win_non_mail_client_imap.yml","source_sha256":"ac2381308b853d82384f1a108025735c0adce44488bb4a3c6ed28bf4b6b030d1","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/network_connection/net_connection_win_non_mail_client_imap.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: Non-Mail Client IMAP Connection Hunt Starter\nid: 0f9486c4-2270-4a13-9bd8-f37d3017f7b7\nstatus: experimental\ndescription: >\n  Detects non-mail-client processes establishing outbound IMAP or IMAPS connections.\n  This is a behavior-level hunt for IMAPLoader-style command and control associated\n  with Imperial Kitten / Yellow Liderc reporting. Tune approved automation and legacy\n  mail clients before alerting; this selector is intentionally broad.\nreferences:\n    - https://www.crowdstrike.com/en-us/blog/imperial-kitten-deploys-novel-malware-families/\n    - https://www.pwc.com/gx/en/issues/cybersecurity/cyber-threat-intelligence/yellow-liderc-ships-its-scripts-delivers-imaploader-malware.html\nauthor: Andrey Pautov\ndate: 2026-05-14\ntags:\n    - attack.command-and-control\n    - attack.t1071.003\nlogsource:\n    product: windows\n    category: network_connection\ndetection:\n    selection_ports:\n        DestinationPort:\n            - 143\n            - 993\n    filter_mail_clients:\n        Image|endswith:\n            - '\\OUTLOOK.EXE'\n            - '\\outlook.exe'\n            - '\\thunderbird.exe'\n            - '\\olk.exe'\n    condition: selection_ports and not filter_mail_clients\nfields:\n    - UtcTime\n    - Computer\n    - User\n    - Image\n    - DestinationHostname\n    - DestinationIp\n    - DestinationPort\nfalsepositives:\n    - Approved mail clients not included in the local allowlist.\n    - Legacy mail-collection scripts or monitoring agents that use IMAP.\nlevel: low\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1071.003","id":"T1071.003","name":"Mail Protocols","page":"techniques/enterprise/T1071.003/"}],"data_path":"data/detection-rules/0f9486c4-2270-4a13-9bd8-f37d3017f7b7.json","kind":"sigma"}