IMAP Email Account Takeover Brute Force

Darshan Thummar@Mighty

•updated Jun 10, 2026•0•0•2

This rule detects a brute-force attack against an IMAP email account. It triggers when a source IP attempts to connect to the IMAP port (993) on the home network 20 or more times within a 30-second window. This behavior is indicative of an attacker repeatedly trying different credentials to gain unauthorized access to an email account.