ATT&CK T1114 - IMAP Mass Email Collection

Darshan Thummar@Mighty

•updated Jun 10, 2026•1•0•5

This rule detects potential mass email collection activity over IMAP (port 143). It triggers an alert if a client makes 20 or more 'FETCH BODY[]' requests within a 60-second window to an IMAP server. This behavior is indicative of an attacker or malicious script attempting to download a large number of email bodies, potentially for data exfiltration or analysis.