Potential Data Exfiltration Over SMTP Via Send-MailMessage Cmdlet
This rule detects the execution of a PowerShell script that utilizes the "Send-MailMessage" cmdlet along with the "-Attachments" flag. This combination is a strong indicator of potential data exfiltration via email, where an adversary might be sending sensitive files as attachments through SMTP. The rule aims to identify attempts to steal data by exfiltrating it over an unencrypted network protocol, specifically SMTP, to an alternative network location.
Sigma
