Windows Suspicious Outbound SMTP Connections on Ports 25/465/587/2525

title: Windows Suspicious Outbound SMTP Connections on Ports 25/465/587/2525
id: dc750644-13d3-4f34-ae0a-bdde610b394c
status: test
description: This rule flags initiated outbound network connections from endpoints to SMTP-related service ports (25, 465, 587, and 2525) on Windows. Attackers may use alternate application-layer protocols like SMTP to exfiltrate data or relay it to systems outside the primary command-and-control path. Telemetry relies on network connection events that include destination port, connection initiation state, and process image paths to filter out common mail client and Exchange activity patterns.
references:
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1048.003/T1048.003.md#atomic-test-5---exfiltration-over-alternative-protocol---smtp
  - https://www.ietf.org/rfc/rfc2821.txt
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/network_connection/net_connection_win_susp_outbound_smtp_connections.yml
author: frack113, Huntrule Team
date: 2022-01-07
modified: 2022-09-21
tags:
  - attack.exfiltration
  - attack.t1048.003
logsource:
  category: network_connection
  product: windows
detection:
  selection:
    DestinationPort:
      - 25
      - 587
      - 465
      - 2525
    Initiated: "true"
  filter_clients:
    Image|endswith:
      - \thunderbird.exe
      - \outlook.exe
  filter_mailserver:
    Image|startswith: C:\Program Files\Microsoft\Exchange Server\
  filter_outlook:
    Image|startswith: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_
    Image|endswith: \HxTsr.exe
  condition: selection and not 1 of filter_*
falsepositives:
  - Other SMTP tools
level: medium
license: DRL-1.1
related:
  - id: 9976fa64-2804-423c-8a5b-646ade840773
    type: derived