Mail Server Overload from Email Bombing Attack (Queue Backlog/Latency Spike)
Detects signs of email bombing by monitoring for critical thresholds in mail server queue size, transfer latency, or a significant spike in SMTP connection attempts targeting individual mailboxes. This activity often aims to disrupt email service availability, bury critical alerts, or facilitate social engineering attacks.
Sigma
