Response playbooks, investigation guides, and Atomic Red Team tests are Pro-only. Upgrade to unlock the full detection package for THREAT-SMTP-Exfiltration.
Upgrade to ProDetect Data Exfiltration via Outbound SMTP in CrowdStrike LogScale
A large share of commodity keyloggers and infostealers — Agent Tesla, Formbook, Snake Keylogger, and numerous VB6/AutoIt-based tools — exfiltrate harvested credentials, screenshots, and keystroke logs by connecting directly to an SMTP server (often a throwaway or compromised legitimate mailbox on Gmail, Yandex, or a bulletproof host) and emailing the stolen data as an attachment. This differs from Business Email Compromise data-theft techniques (mailbox rule forwarding, covered under Collection) in that the malware itself is the SMTP client: it authenticates with hardcoded credentials and sends mail directly from the compromised endpoint, generating an outbound SMTP connection (port 25/587/465) from a process that is never normally an email client — a strong, protocol-level anomaly on modern endpoints where nearly all legitimate mail flows through a managed mail server or a browser-based webmail session over HTTPS, not a raw SMTP socket opened by an arbitrary process.
MITRE ATT&CK
- Tactic
- Exfiltration
LogScale Detection Query
#event_simpleName=NetworkConnectIP4
| in(field=RemotePort, values=[25, 465, 587])
| !in(field=ImageFileName, values=["*\\outlook.exe", "*\\thunderbird.exe", "*\\exchange*", "*\\postfix", "*\\sendmail"], ignoreCase=true)
| !cidr(RemoteAddressIP4, subnet="10.0.0.0/8")
| !cidr(RemoteAddressIP4, subnet="172.16.0.0/12")
| !cidr(RemoteAddressIP4, subnet="192.168.0.0/16")
| groupBy([ComputerName, ImageFileName, RemoteAddressIP4], function=count(as=ConnectionCount))
| sort(field=ConnectionCount, order=desc)CrowdStrike Falcon LogScale query over NetworkConnectIP4 sensor events flagging non-mail-client processes connecting outbound on SMTP ports, using the native cidr() filter function to exclude RFC1918 destinations — required because a list-membership (in()) test against a CIDR literal never matches an actual RemoteAddressIP4 value.
Data Sources
Required Tables
False Positives & Tuning
- Legacy line-of-business applications sending transactional email directly via SMTP
- Scripted automation and backup tooling emailing job-completion notifications via an approved relay
- Scan-to-email multi-function printers routing through a workstation-adjacent relay agent
Other platforms for THREAT-SMTP-Exfiltration
Testing Methodology
Validate this detection against 2 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1Simulated Direct SMTP Exfiltration Connection via PowerShell
Expected signal: Sysmon Event ID 3 (Network Connection): powershell.exe connecting to 127.0.0.1:587 (or the configured test relay). DeviceNetworkEvents: connection record with RemotePort=587, InitiatingProcessFileName=powershell.exe. If a local test SMTP listener (e.g. Python smtpd/aiosmtpd) is running to receive the session, its logs will show the EHLO, MAIL FROM, RCPT TO, and DATA commands with the synthetic credential payload.
- Test 2Periodic SMTP Beacon Simulation (Keylogger Exfil Interval Pattern)
Expected signal: Sysmon Event ID 1: update_helper.exe (a copy of powershell.exe) executing from %TEMP%\atomic_smtp_test\. Sysmon Event ID 3: three network connection events to 127.0.0.1:587 spaced ~5 seconds apart, initiated by the temp-directory binary.
References (5)
- https://attack.mitre.org/techniques/T1048/
- https://attack.mitre.org/techniques/T1048/003/
- https://www.fortinet.com/blog/threat-research/agent-tesla-old-cybercrime-rat-new-tricks
- https://www.cisecurity.org/insights/blog/top-10-malware-agent-tesla
- https://github.com/SigmaHQ/sigma/tree/master/rules/network
Unlock playbooks & atomic tests with Pro
Get the full detection package for THREAT-SMTP-Exfiltration — response playbook and atomic red team tests, plus investigation guidance and hunting queries.
df00tech Pro — £29/user/month