ATT&CK T1114 - IMAP Mass Email Collection

nomit vyas@xoxo

•updated Jun 24, 2026•0•0•2

This rule detects potential mass email collection activity over IMAP (port 143). It triggers when a client sends a 'FETCH' command followed by 'BODY[]' content at least 20 times within 60 seconds from the same source IP address. This behavior is indicative of an adversary attempting to download a large number of email bodies, which is a common method for email collection.