POP3 Email Account Credential Brute Force

Darshan Thummar@Mighty

•updated Jun 10, 2026•0•0•9

This rule detects a brute-force attack against a POP3 email account. It triggers when 20 or more TCP connections are made to port 995 (POP3S) on the HOME_NET within a 30-second window from the same source IP address. This pattern is indicative of an attacker repeatedly attempting to guess credentials.