Application Layer SMTP Protocol Used for C2 Channel

Darshan Thummar@Mighty

•updated Jun 12, 2026•0•0•1

This rule detects potential command and control (C2) communication over SMTP by looking for repeated 'EHLO' commands within a short timeframe from the same source IP address. The threshold is set to trigger if 10 'EHLO' commands are observed within 300 seconds (5 minutes) from a single source.