Outbound Email Bombing Campaign Detected
This rule detects an outbound email bombing campaign by monitoring TCP connections to port 25 (SMTP). It triggers an alert if a single source IP address initiates 200 or more established connections to port 25 within a 60-second window. This high volume of outbound email connections from a single source is indicative of an attempt to overwhelm an email server or recipient with a large number of emails, often associated with denial-of-service attacks.
Suricata
