T1667 — Email Bombing

Tactic: Impact · Platforms: Linux, Office Suite, Windows, macOS

Adversaries may flood targeted email addresses with an overwhelming volume of messages. This may bury legitimate emails in a flood of spam and disrupt business operations. An adversary may accomplish email bombing by leveraging an automated bot to register a targeted address for e-mail lists that…

Sigma detection rules (4)

T1667 Email Bombing

title: T1667 Email Bombing
id: c733895b-042d-4ac8-bc72-54613ca95211
description: 'Detects rapid creation of individual mail-message files (.msg/.eml) inside a local Outlook data-file cache, a weak endpoint-side signal that may accompany an email-bombing flood. NOTE: email bombing is fundamentally a mail-flow/volumetric attack best observed at the mail gateway or via message-trace/SMTP logs, not Windows Sysmon telemetry -- Sysmon only sees individual file-creation events, not aggregate send/receive volume, so this rule is a proxy that requires pairing with a correlation rule (event_count, group-by Computer, timespan 5m, condition gte ~200) to approximate bombing rather than normal mail arrival. Tune using: TimeWindow, RecipientThreshold, AttachmentSizeThreshold.'
references:
  - https://attack.mitre.org/techniques/T1667
author: Shahrukh Khan
date: 2026-06-09
license: MIT
tags:
  - attack.impact
  - attack.t1667

logsource:
  category: file_event
  product: windows
  service: sysmon

detection:
  selection:
    TargetFilename|contains: '\Outlook\'
    TargetFilename|endswith:
      - '.msg'
      - '.eml'

  filter_system_account:
    User|contains:
      - 'SYSTEM'
      - 'LOCAL SERVICE'
      - 'NETWORK SERVICE'

  condition: selection and not filter_system_account

falsepositives:
  - Normal mail arrival generates the same file-creation events; this rule is only meaningful when paired with a volumetric correlation rule/threshold -- as a standalone single-event rule it will fire on every incoming email and is not a reliable standalone bombing indicator. System and service accounts are excluded via filter_system_account.

level: low

T1667 Email Bombing

title: T1667 Email Bombing
id: c6d0e998-8427-4883-bd11-affef23e9ef1
description: 'Detects creation of new mail-queue files in the local MTA spool directories, the closest single-event auditd-observable proxy for email-bombing (bulk registration/spam flood); auditd cannot natively measure per-recipient volume or rate, so sustained bombing must be confirmed via a downstream count/rate correlation (e.g. MailVolumeThreshold events per recipient per minute) rather than this single PATH CREATE event alone. Fixed: service was declared syslog while using auditd-only record fields (type/nametype), an invalid combination - now correctly declared as service: auditd. Tune using: MailVolumeThreshold, AttachmentPatternList.'
references:
  - https://attack.mitre.org/techniques/T1667
author: Shahrukh Khan
date: 2026-02-27
license: MIT
tags:
  - attack.impact
  - attack.t1667

logsource:
  category: file_event
  product: linux
  service: auditd

detection:
  selection_queue:
    name|contains:
      - '/var/spool/postfix/maildrop/'
      - '/var/spool/mail/'
  selection_type:
    type: 'PATH'
    nametype: 'CREATE'

  condition: selection_queue and selection_type

falsepositives:
  - Legitimate bulk-mail campaigns, newsletter systems, or backup notification jobs; a single CREATE event cannot distinguish bombing from normal delivery volume - this rule is a seed event for a rate-based correlation, not a standalone high-confidence alert.

level: medium

T1667 Email Bombing

title: T1667 Email Bombing
id: eff927c9-aa7b-498e-9429-169a2a190162
description: 'Detection Strategy for Email Bombing. (Retargeted to the process_creation macOS unified-log telemetry that actually captures this techniques behavior; see logsource below.) Tune using: FileCountThreshold.'
references:
  - https://attack.mitre.org/techniques/T1667
author: Shahrukh Khan
date: 2026-06-27
license: MIT
tags:
  - attack.impact
  - attack.t1667

logsource:
  category: process_creation
  product: macos

detection:
  selection:
    Image|endswith: '/Mail.app/Contents/MacOS/Mail'

  condition: selection

falsepositives:
  - Unified log application telemetry for Mail.app does not expose a per-minute inbound message count, so this rule cannot actually measure the volume threshold that defines email bombing and would need correlation with a mail server or MDM mailbox API instead.

level: low

T1667 Email Bombing

title: T1667 Email Bombing
id: 88b397ba-8d4f-403f-95c9-6a6699d5fbf3
description: 'Detection Strategy for Email Bombing. (Data Component: Application Log Content; baseline tier: fallback.) Tune using: UserContext.'
references:
  - https://attack.mitre.org/techniques/T1667
author: Shahrukh Khan
date: 2026-06-11
license: MIT
tags:
  - attack.impact
  - attack.t1667

logsource:
  product: m365
  service: exchange

detection:
  selection:
    Operation:
      - 'Remove-DistributionGroupMember'
      - 'Set-Mailbox'
    Parameters.Name: 'HiddenFromAddressListsEnabled'
    Parameters.Value: 'True'

  condition: selection

falsepositives:
  - Administrators legitimately hiding service or resource mailboxes from the global address list as part of standard provisioning.

level: medium

Explore