All Detections

Gamaredon - Compromised Government SMTP Client Subnet

avatar
Ibrahim Saud@tektrix
updated Jun 20, 2026005

Detects SMTP connections originating from the persistent Gamaredon operator subnet (194.58.66.0/24) on port 25.

Microsoft Sentinel (KQL)