PowerShell Script Exfiltration Attempt: Send-MailMessage with Attachments

Detects PowerShell Send-MailMessage usage with -Attachments, which may indicate SMTP-based data exfiltration.

FreeReviewedSigma · Medium · v5

Product: windows
Category: ps_script
Author: frack113 (SigmaHQ), DRL 1.1
Published: 2022-09-26
Updated: 2026-07-31

ATT&CK techniques

Exfiltration

Recon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
- T1048.003Exfiltration Over Unencrypted Non-C2 Protocol
Impact

What it detects

This rule flags PowerShell script block executions that include the Send-MailMessage cmdlet together with the -Attachments parameter. Attackers can use email delivery to move sensitive data out of the environment by packaging it as attachments, potentially bypassing controls tied to the primary command-and-control path. Detection relies on Script Block Logging telemetry that captures the executed script text.

Reporting behind it

Related detections9 linkedT1048.003 — drag to rearrange

FTP Data Exfiltration via curl with Embedded Credentials

Suspicious Data Exfiltration via TFTP Client

Suspicious Finger Client Execution for Command and Control

Malicious dnscat2 DNS Tunneling C2 Traffic

Suspicious Data Transfer via curl to Raw IP Address

Linux Python CLI Web Server Execution via http.server or SimpleHTTPServer

Windows svchost.exe Spawning rundll32.exe with WebDav davclnt.dll DavSetCookie

Windows Suspicious Outbound SMTP Connections on Common Mail Ports

Linux wget POST-file Usage Indicating Data Exfiltration

PowerShell Script Exfiltration Attempt: Send-MailMessage with Attachments

Pivot detection · T1048.003 · 9 related

Changelog

v5
Candidate ingested via manual entry.2026-07-31
v4
Candidate ingested via manual entry.2026-07-31
v3
Candidate ingested via manual entry.2026-07-31
v2
Candidate ingested via manual entry.2026-07-31
v1
No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

powershell-scriptblock-send-mailmessage-with-attachments-for-possible-smtp-data--9a7afa56

title: "PowerShell Script Exfiltration Attempt: Send-MailMessage with Attachments"
id: 3eb25d1d-16fb-47e4-b3de-ed788c6fa416
status: test
description: This rule flags PowerShell script block executions that include the Send-MailMessage cmdlet together with the -Attachments parameter. Attackers can use email delivery to move sensitive data out of the environment by packaging it as attachments, potentially bypassing controls tied to the primary command-and-control path. Detection relies on Script Block Logging telemetry that captures the executed script text.
references:
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1048.003/T1048.003.md#atomic-test-5---exfiltration-over-alternative-protocol---smtp
  - https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.utility/send-mailmessage?view=powershell-7.4
  - https://www.ietf.org/rfc/rfc2821.txt
  - https://github.com/SigmaHQ/sigma/blob/master/rules-threat-hunting/windows/powershell/powershell_script/posh_ps_send_mailmessage.yml
author: frack113, Huntrule Team
date: 2022-09-26
modified: 2024-11-01
tags:
  - attack.exfiltration
  - attack.t1048.003
  - detection.threat-hunting
logsource:
  product: windows
  category: ps_script
  definition: "Requirements: Script Block Logging must be enabled"
detection:
  selection:
    ScriptBlockText|contains: Send-MailMessage*-Attachments
  condition: selection
falsepositives:
  - Unknown
level: medium
license: DRL-1.1
related:
  - id: 9a7afa56-4762-43eb-807d-c3dc9ffe211b
    type: derived

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL