SMTP Submission Large Data Exfiltration

Darshan Thummar@Mighty

•updated Jun 10, 2026•0•0•1

This rule detects large data exfiltration attempts over SMTP Submission (port 587). It triggers an alert if more than 50,000 bytes of data are sent from a single source IP address to a server via SMTP Submission, with a threshold of 5 such events within a 300-second window. This indicates a potential policy violation related to data exfiltration.