IMAP Remote Email Bulk Collection Detected

Darshan Thummar@Mighty

•updated Jun 12, 2026•0•0•5

This rule detects potential bulk email collection activity over IMAP. It triggers when a client makes 30 or more IMAP 'FETCH' commands containing 'BODY[]' (indicating a request for the full email body) to a server on port 143 within a 60-second window. This behavior can be indicative of an attacker or malicious insider exfiltrating a large number of emails from an IMAP server.