Bulk Phishing Campaign Delivery Detected

Darshan Thummar@Mighty

•updated Jun 10, 2026•0•0•1

This rule detects bulk phishing campaign delivery by monitoring SMTP traffic for a high volume of emails containing the 'Subject:' header. Specifically, it triggers an alert if 20 or more emails with a 'Subject:' header are sent to the internal network (HOME_NET) on port 25 within a 60-second window from the same source.