ATT&CK T1534 - Internal SMTP Lateral Phishing

Darshan Thummar@Mighty

•updated Jun 10, 2026•0•0•4

This rule detects internal SMTP traffic that contains both 'Content-Type: application/' and 'filename=' in the email body. This combination is often indicative of an attachment being sent, and in the context of 'Lateral Phishing' (T1534), it suggests an attempt to send malicious attachments internally. The rule is set to trigger an alert if 5 such events occur from the same source IP within 300 seconds, indicating a potential automated or high-volume internal phishing attempt.