ATT&CK T1071.003 - SMTP C2 Channel Detected

Darshan Thummar@Mighty

•updated Jun 10, 2026•0•0•3

This rule detects potential Command and Control (C2) communication over SMTP (port 25). It specifically looks for TCP traffic originating from the home network to any destination on port 25, indicating an established connection. A threshold of 10 connections within 300 seconds from the same source IP is set to reduce false positives, suggesting a high volume of SMTP activity that could be indicative of C2.