Non-Mail Client IMAP Connection Hunt Starter — Sigma Rule

Rule metadata and linked tags

Author: Andrey Pautov. Source status: experimental; severity: low. Source dates: 2026-05-14 / not supplied.

{
  "product": "windows",
  "category": "network_connection"
}

Pinned original Sigma rule · Detection Rule License 1.1

Source SHA-256: ac2381308b853d82384f1a108025735c0adce44488bb4a3c6ed28bf4b6b030d1

Detection logic

Original source YAML. Source-tag agreement is not proof of complete semantic coverage. This rule has not been compiled for a SIEM backend or validated against live telemetry here.

title: Non-Mail Client IMAP Connection Hunt Starter
id: 0f9486c4-2270-4a13-9bd8-f37d3017f7b7
status: experimental
description: >
  Detects non-mail-client processes establishing outbound IMAP or IMAPS connections.
  This is a behavior-level hunt for IMAPLoader-style command and control associated
  with Imperial Kitten / Yellow Liderc reporting. Tune approved automation and legacy
  mail clients before alerting; this selector is intentionally broad.
references:
    - https://www.crowdstrike.com/en-us/blog/imperial-kitten-deploys-novel-malware-families/
    - https://www.pwc.com/gx/en/issues/cybersecurity/cyber-threat-intelligence/yellow-liderc-ships-its-scripts-delivers-imaploader-malware.html
author: Andrey Pautov
date: 2026-05-14
tags:
    - attack.command-and-control
    - attack.t1071.003
logsource:
    product: windows
    category: network_connection
detection:
    selection_ports:
        DestinationPort:
            - 143
            - 993
    filter_mail_clients:
        Image|endswith:
            - '\OUTLOOK.EXE'
            - '\outlook.exe'
            - '\thunderbird.exe'
            - '\olk.exe'
    condition: selection_ports and not filter_mail_clients
fields:
    - UtcTime
    - Computer
    - User
    - Image
    - DestinationHostname
    - DestinationIp
    - DestinationPort
falsepositives:
    - Approved mail clients not included in the local allowlist.
    - Legacy mail-collection scripts or monitoring agents that use IMAP.
level: low

Original YAML and metadata in JSON

False positives

• Approved mail clients not included in the local allowlist.
• Legacy mail-collection scripts or monitoring agents that use IMAP.

Source references

• https://www.crowdstrike.com/en-us/blog/imperial-kitten-deploys-novel-malware-families/
• https://www.pwc.com/gx/en/issues/cybersecurity/cyber-threat-intelligence/yellow-liderc-ships-its-scripts-delivers-imaploader-malware.html