ATT&CK T1114 - IMAP/SSL Mass Email Collection

Darshan Thummar@Mighty

•updated Jun 10, 2026•0•0•2

This rule detects a high volume of IMAP/SSL connections to port 993 from a single source IP address within a short timeframe, which could indicate an attempt to collect emails in bulk, potentially associated with MITRE ATT&CK technique T1114 (Email Collection). The threshold is set to 30 connections within 60 seconds from the same source.