SMTP Large Attachment Exfiltration

Darshan Thummar@Mighty

•updated Jun 10, 2026•0•0•1

This rule detects large attachments being exfiltrated via SMTP. Specifically, it looks for SMTP traffic on port 25, flowing to the server, that contains the 'Content-Transfer-Encoding: base64' header and has a data size greater than 50,000 bytes. This combination suggests a large, base64-encoded file being sent as an email attachment, which could indicate data exfiltration.