Detect Mail Protocols in Google Chronicle

rule t1071_003_non_mail_process_mail_protocol {
  meta:
    author = "Argus Detection Engineering"
    description = "Detects non-standard processes making repeated outbound connections to mail protocol ports (SMTP/POP3/IMAP), indicative of T1071.003 adversarial C2 over mail protocols"
    severity = "HIGH"
    priority = "HIGH"
    mitre_attack_tactic = "Command and Control"
    mitre_attack_technique = "T1071.003"
    reference = "https://attack.mitre.org/techniques/T1071/003/"
    created = "2026-01-01"
    version = "1.0"

  events:
    $e.metadata.event_type = "NETWORK_CONNECTION"
    $e.network.direction = "OUTBOUND"
    (
      $e.target.port = 25 or
      $e.target.port = 465 or
      $e.target.port = 587 or
      $e.target.port = 110 or
      $e.target.port = 995 or
      $e.target.port = 143 or
      $e.target.port = 993
    )
    not re.regex(
      $e.principal.process.file.full_path,
      `(?i)(outlook|thunderbird|mailclient|em\.client|msedge|chrome|firefox|safari)\.exe`
    )
    $host = $e.principal.hostname
    $proc = $e.principal.process.file.full_path
    $dest_ip = $e.target.ip

  match:
    $host, $proc, $dest_ip over 24h

  condition:
    #e > 2
}