Response playbooks, investigation guides, and Atomic Red Team tests are Pro-only. Upgrade to unlock the full detection package for THREAT-SMTP-Exfiltration.
Upgrade to ProDetect Data Exfiltration via Outbound SMTP in IBM QRadar
A large share of commodity keyloggers and infostealers — Agent Tesla, Formbook, Snake Keylogger, and numerous VB6/AutoIt-based tools — exfiltrate harvested credentials, screenshots, and keystroke logs by connecting directly to an SMTP server (often a throwaway or compromised legitimate mailbox on Gmail, Yandex, or a bulletproof host) and emailing the stolen data as an attachment. This differs from Business Email Compromise data-theft techniques (mailbox rule forwarding, covered under Collection) in that the malware itself is the SMTP client: it authenticates with hardcoded credentials and sends mail directly from the compromised endpoint, generating an outbound SMTP connection (port 25/587/465) from a process that is never normally an email client — a strong, protocol-level anomaly on modern endpoints where nearly all legitimate mail flows through a managed mail server or a browser-based webmail session over HTTPS, not a raw SMTP socket opened by an arbitrary process.
MITRE ATT&CK
- Tactic
- Exfiltration
QRadar Detection Query
SELECT
sourceip AS SourceIP,
destinationip AS DestinationIP,
destinationport AS DestinationPort,
"Application Name" AS ProcessName,
COUNT(*) AS ConnectionCount,
MIN(starttime) AS FirstSeen,
MAX(starttime) AS LastSeen
FROM flows
WHERE
(destinationport = 25 OR destinationport = 465 OR destinationport = 587)
AND "Application Name" NOT IN ('outlook.exe', 'thunderbird.exe', 'exchange', 'postfix', 'sendmail')
AND NOT INCIDR('10.0.0.0/8', destinationip)
AND NOT INCIDR('172.16.0.0/12', destinationip)
AND NOT INCIDR('192.168.0.0/16', destinationip)
AND starttime > (NOW() - 86400000)
GROUP BY sourceip, destinationip, destinationport, "Application Name"
ORDER BY ConnectionCount DESCQRadar AQL query against the flows table for outbound SMTP-port connections from any process other than a recognized mail client, excluding RFC1918 destinations via the INCIDR() range-match function — the AQL equivalent of ipv4_is_in_range/cidrmatch, required because a plain string-equality NOT IN clause against a CIDR literal cannot match a real destinationip value.
Data Sources
Required Tables
False Positives & Tuning
- Legacy line-of-business applications sending transactional email directly via SMTP
- Scripted automation and backup tooling emailing job-completion notifications via an approved relay
- Scan-to-email multi-function printers routing through a workstation-adjacent relay agent
Other platforms for THREAT-SMTP-Exfiltration
Testing Methodology
Validate this detection against 2 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1Simulated Direct SMTP Exfiltration Connection via PowerShell
Expected signal: Sysmon Event ID 3 (Network Connection): powershell.exe connecting to 127.0.0.1:587 (or the configured test relay). DeviceNetworkEvents: connection record with RemotePort=587, InitiatingProcessFileName=powershell.exe. If a local test SMTP listener (e.g. Python smtpd/aiosmtpd) is running to receive the session, its logs will show the EHLO, MAIL FROM, RCPT TO, and DATA commands with the synthetic credential payload.
- Test 2Periodic SMTP Beacon Simulation (Keylogger Exfil Interval Pattern)
Expected signal: Sysmon Event ID 1: update_helper.exe (a copy of powershell.exe) executing from %TEMP%\atomic_smtp_test\. Sysmon Event ID 3: three network connection events to 127.0.0.1:587 spaced ~5 seconds apart, initiated by the temp-directory binary.
References (5)
- https://attack.mitre.org/techniques/T1048/
- https://attack.mitre.org/techniques/T1048/003/
- https://www.fortinet.com/blog/threat-research/agent-tesla-old-cybercrime-rat-new-tricks
- https://www.cisecurity.org/insights/blog/top-10-malware-agent-tesla
- https://github.com/SigmaHQ/sigma/tree/master/rules/network
Unlock playbooks & atomic tests with Pro
Get the full detection package for THREAT-SMTP-Exfiltration — response playbook and atomic red team tests, plus investigation guidance and hunting queries.
df00tech Pro — £29/user/month