Windows Suspicious Outbound SMTP Connections on Common Mail Ports

Alerts on outbound, initiated SMTP connections to ports 25/465/587/2525, excluding specific mail/Exchange processes.

FreeReviewedSigma · Medium · v2

Product: windows
Category: network_connection
Author: frack113 (SigmaHQ), DRL 1.1
Published: 2022-01-07
Updated: 2026-07-31

ATT&CK techniques

Exfiltration

Recon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
- T1048.003Exfiltration Over Unencrypted Non-C2 Protocol
Impact

What it detects

This rule flags outbound TCP connections initiated to common SMTP submission and relay ports (25, 465, 587, 2525) on Windows. Attackers may use SMTP to exfiltrate data over an unencrypted channel or to send data to an alternate external location instead of the primary command-and-control path. It relies on network connection telemetry with destination port and connection initiation indicators, and suppresses matches from specific mail clients and Microsoft Exchange app paths referenced by the rule.

Reporting behind it

Related detections9 linkedT1048.003 — drag to rearrange

FTP Data Exfiltration via curl with Embedded Credentials

Suspicious Data Exfiltration via TFTP Client

Suspicious Finger Client Execution for Command and Control

Malicious dnscat2 DNS Tunneling C2 Traffic

Suspicious Data Transfer via curl to Raw IP Address

Linux Python CLI Web Server Execution via http.server or SimpleHTTPServer

Windows svchost.exe Spawning rundll32.exe with WebDav davclnt.dll DavSetCookie

PowerShell Script Exfiltration Attempt: Send-MailMessage with Attachments

Linux wget POST-file Usage Indicating Data Exfiltration

Windows Suspicious Outbound SMTP Connections on Common Mail Ports

Pivot detection · T1048.003 · 9 related

Changelog

v2
Candidate ingested via manual entry.2026-07-31
v1
No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

windows-suspicious-outbound-smtp-connections-on-ports-25-465-587-2525-9976fa64

title: Windows Suspicious Outbound SMTP Connections on Common Mail Ports
id: dc750644-13d3-4f34-ae0a-bdde610b394c
status: test
description: This rule flags outbound TCP connections initiated to common SMTP submission and relay ports (25, 465, 587, 2525) on Windows. Attackers may use SMTP to exfiltrate data over an unencrypted channel or to send data to an alternate external location instead of the primary command-and-control path. It relies on network connection telemetry with destination port and connection initiation indicators, and suppresses matches from specific mail clients and Microsoft Exchange app paths referenced by the rule.
references:
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1048.003/T1048.003.md#atomic-test-5---exfiltration-over-alternative-protocol---smtp
  - https://www.ietf.org/rfc/rfc2821.txt
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/network_connection/net_connection_win_susp_outbound_smtp_connections.yml
author: frack113, Huntrule Team
date: 2022-01-07
modified: 2022-09-21
tags:
  - attack.exfiltration
  - attack.t1048.003
logsource:
  category: network_connection
  product: windows
detection:
  selection:
    DestinationPort:
      - 25
      - 587
      - 465
      - 2525
    Initiated: "true"
  filter_clients:
    Image|endswith:
      - \thunderbird.exe
      - \outlook.exe
  filter_mailserver:
    Image|startswith: C:\Program Files\Microsoft\Exchange Server\
  filter_outlook:
    Image|startswith: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_
    Image|endswith: \HxTsr.exe
  condition: selection and not 1 of filter_*
falsepositives:
  - Other SMTP tools
level: medium
license: DRL-1.1
related:
  - id: 9976fa64-2804-423c-8a5b-646ade840773
    type: derived

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL