{"id":"9976fa64-2804-423c-8a5b-646ade840773","title":"Suspicious Outbound SMTP Connections","description":"Adversaries may steal data by exfiltrating it over an un-encrypted network protocol other than that of the existing command and control channel.\nThe data may also be sent to an alternate network location from the main command and control server.\n","author":"frack113","status":"test","level":"medium","date":"2022-01-07","modified":"2022-09-21","tags":["attack.exfiltration","attack.t1048.003"],"technique_ids":["T1048.003"],"logsource":{"category":"network_connection","product":"windows"},"falsepositives":["Other SMTP tools"],"references":["https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1048.003/T1048.003.md#atomic-test-5---exfiltration-over-alternative-protocol---smtp","https://www.ietf.org/rfc/rfc2821.txt"],"source_path":"rules/windows/network_connection/net_connection_win_susp_outbound_smtp_connections.yml","source_sha256":"4b00aa101fb2992d5ec7d68a1eece882266289a4f15774b7f9fdcda2eb07e891","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/network_connection/net_connection_win_susp_outbound_smtp_connections.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: Suspicious Outbound SMTP Connections\nid: 9976fa64-2804-423c-8a5b-646ade840773\nstatus: test\ndescription: |\n    Adversaries may steal data by exfiltrating it over an un-encrypted network protocol other than that of the existing command and control channel.\n    The data may also be sent to an alternate network location from the main command and control server.\nreferences:\n    - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1048.003/T1048.003.md#atomic-test-5---exfiltration-over-alternative-protocol---smtp\n    - https://www.ietf.org/rfc/rfc2821.txt\nauthor: frack113\ndate: 2022-01-07\nmodified: 2022-09-21\ntags:\n    - attack.exfiltration\n    - attack.t1048.003\nlogsource:\n    category: network_connection\n    product: windows\ndetection:\n    selection:\n        DestinationPort:\n            - 25\n            - 587\n            - 465\n            - 2525\n        Initiated: 'true'\n    filter_clients:\n        Image|endswith:\n            - \\thunderbird.exe\n            - \\outlook.exe\n    filter_mailserver:\n        Image|startswith: 'C:\\Program Files\\Microsoft\\Exchange Server\\'\n    filter_outlook:\n        Image|startswith: 'C:\\Program Files\\WindowsApps\\microsoft.windowscommunicationsapps_'\n        Image|endswith: '\\HxTsr.exe'\n    condition: selection and not 1 of filter_*\nfalsepositives:\n    - Other SMTP tools\nlevel: medium\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1048.003","id":"T1048.003","name":"Exfiltration Over Unencrypted Non-C2 Protocol","page":"techniques/enterprise/T1048.003/"}],"data_path":"data/detection-rules/9976fa64-2804-423c-8a5b-646ade840773.json","kind":"sigma"}