T1071.003 — Mail Protocols

Tactic: Command and Control · Platforms: Linux, macOS, Network Devices, Windows

Adversaries may communicate using application layer protocols associated with electronic mail delivery to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic…

Sub-technique of Application Layer Protocol (T1071).

Sigma detection rules (4)

T1071.003 Application Layer Protocol: Mail Protocols

title: "T1071.003 Application Layer Protocol: Mail Protocols"
id: 8a370fac-b9b9-4013-bece-fa551ba8b91c
description: 'Detection of Mail Protocol-Based C2 Activity (SMTP, IMAP, POP3). (Retargeted from the original process_creation label to network_connection — this is the telemetry source that actually captures this technique''s behavior; see logsource below.) Tune using: ProcessImageName, DestPortFilter, AttachmentType.'
references:
  - https://attack.mitre.org/techniques/T1071/003
author: Shahrukh Khan
date: 2026-01-25
license: MIT
tags:
  - attack.command-and-control
  - attack.t1071.003

logsource:
  category: network_connection
  product: windows
  service: sysmon

detection:
  selection:
    DestinationPort:
      - 25
      - 587
      - 465
    Image|endswith:
      - '\powershell.exe'
      - '\cmd.exe'

  condition: selection

falsepositives:
  - Legitimate scripted mail-relay testing or automated notification scripts sending SMTP directly from a script host.

level: medium

T1071.003 Application Layer Protocol: Mail Protocols

title: "T1071.003 Application Layer Protocol: Mail Protocols"
id: d574c9af-b109-4189-bcd8-e9a846b0ed13
description: 'Detection of Mail Protocol-Based C2 Activity (SMTP, IMAP, POP3). Broadened beyond command-line string matches (curl smtp://, python3/perl smtplib) to also flag outbound connections to standard mail ports (25/587/465/110/995/143/993) from processes that are not known MTA/MUA binaries, since script-based smtplib usage rarely appears literally in argv. (Retargeted to the process_creation/network_connection auditd telemetry that actually captures this techniques behavior; see logsource below.) Tune using: TransferSizeThreshold, ScriptNameFilter, MailClientAllowlist.'
references:
  - https://attack.mitre.org/techniques/T1071/003
author: Shahrukh Khan
date: 2026-04-18
license: MIT
tags:
  - attack.command-and-control
  - attack.t1071.003

logsource:
  category: network_connection
  product: linux
  service: auditd

detection:
  selection_cli_curl:
    type: EXECVE
    a0|endswith: '/curl'
    a1|contains: 'smtp://'
  selection_cli_py:
    type: EXECVE
    a0|endswith:
      - '/python3'
      - '/perl'
    a1|contains: 'smtplib'
  selection_connect:
    type: SYSCALL
    syscall: connect
  selection_mail_ports:
    saddr|contains:
      - 'serv:25'
      - 'serv:587'
      - 'serv:465'
      - 'serv:110'
      - 'serv:995'
      - 'serv:143'
      - 'serv:993'
  filter_known_mail_binaries:
    exe|endswith:
      - '/sendmail'
      - '/postfix'
      - '/exim4'
      - '/exim'
      - '/dovecot'
      - '/msmtp'
      - '/mutt'
      - '/neomutt'
      - '/thunderbird'
      - '/postdrop'
      - '/master'

  condition: 1 of selection_cli_* or (selection_connect and selection_mail_ports and not filter_known_mail_binaries)

falsepositives:
  - Legitimate scripts send mail notifications via curl/smtplib; auditd cannot inspect the actual SMTP payload for C2 markers, only the invoking command line or destination port.
  - Non-mail-client processes that legitimately connect out on mail ports (health-check tools, custom relay wrappers not in the exclusion list) will trigger the network-based branch and require allowlist tuning.

level: low

T1071.003 Application Layer Protocol: Mail Protocols

title: "T1071.003 Application Layer Protocol: Mail Protocols"
id: a3e67a46-321a-4caa-b132-dbabcec1d65a
description: 'Detection of Mail Protocol-Based C2 Activity (SMTP, IMAP, POP3). (Retargeted to the process_creation macOS unified-log telemetry that actually captures this techniques behavior; see logsource below.) Tune using: UserContext, TimeWindow.'
references:
  - https://attack.mitre.org/techniques/T1071/003
author: Shahrukh Khan
date: 2026-02-25
license: MIT
tags:
  - attack.command-and-control
  - attack.t1071.003

logsource:
  category: process_creation
  product: macos

detection:
  selection:
    Image|endswith: '/osascript'
    CommandLine|contains: 'tell application "Mail"'

  condition: selection

falsepositives:
  - Automated reporting scripts that use AppleScript to send status emails via Mail.app trigger the same events.

level: medium

T1071.003 Application Layer Protocol: Mail Protocols

title: "T1071.003 Application Layer Protocol: Mail Protocols"
id: dd85b0a9-edb6-4a1a-9f4b-c93e65daa59b
description: 'Detection of Mail Protocol-Based C2 Activity (SMTP, IMAP, POP3). (Data Component: Network Traffic Content; baseline tier: fallback.) Tune using: ExternalMailRelayFilter, OutflowToInflowRatio.'
references:
  - https://attack.mitre.org/techniques/T1071/003
author: Shahrukh Khan
date: 2026-02-24
license: MIT
tags:
  - attack.command-and-control
  - attack.t1071.003

logsource:
  product: nsm
  service: flow

detection:
  selection_mail_service:
    service:
      - 'smtp'
      - 'pop3'
      - 'imap'
  selection_outbound_heavy:
    orig_bytes|gte: 1000000
    resp_bytes|lte: 50000

  condition: selection_mail_service and selection_outbound_heavy

falsepositives:
  - Legitimate outbound bulk email campaigns or large attachment sends through an approved mail relay.

level: medium

Related sub-techniques

Explore