Non-Mail Process SMTP Exfiltration (Agent Tesla)
Detects outbound SMTP connections from processes that are not typical mail clients, a technique used by malware like Agent Tesla to exfiltrate stolen data. This rule specifically looks for .NET utilities known to be abused in process hollowing attacks.
Microsoft Sentinel (KQL)
