Mail Server Discovery via DNS MX Lookup
This rule detects DNS queries for Mail Exchanger (MX) records. A high volume of MX record lookups from a single source IP address within a short timeframe (10 queries in 30 seconds) is indicative of network scanning activity, specifically reconnaissance to discover mail servers. This could be a precursor to targeted attacks like phishing or email spoofing.
Suricata
