Detect Data Exfiltration via Outbound SMTP in Sumo Logic CSE
A large share of commodity keyloggers and infostealers — Agent Tesla, Formbook, Snake Keylogger, and numerous VB6/AutoIt-based tools — exfiltrate harvested credentials, screenshots, and keystroke logs by connecting directly to an SMTP server (often a throwaway or compromised legitimate mailbox on Gmail, Yandex, or a bulletproof host) and emailing the stolen data as an attachment. This differs from Business Email Compromise data-theft techniques (mailbox rule forwarding, covered under Collection) in that the malware itself is the SMTP client: it authenticates with hardcoded credentials and sends mail directly from the compromised endpoint, generating an outbound SMTP connection (port 25/587/465) from a process that is never normally an email client — a strong, protocol-level anomaly on modern endpoints where nearly all legitimate mail flows through a managed mail server or a browser-based webmail session over HTTPS, not a raw SMTP socket opened by an arbitrary process.
MITRE ATT&CK
- Tactic
- Exfiltration
Sumo Detection Query
_sourceCategory=network/firewall (dest_port=25 OR dest_port=465 OR dest_port=587)
| parse "src_ip=*," as src_ip nodrop
| parse "dst_ip=*," as dst_ip nodrop
| parse "process_name=*," as process_name nodrop
| where !(process_name in ("outlook.exe", "thunderbird.exe", "exchange", "postfix", "sendmail"))
| where !cidr(dst_ip, "10.0.0.0/8") and !cidr(dst_ip, "172.16.0.0/12") and !cidr(dst_ip, "192.168.0.0/16")
| count as ConnectionCount, values(dst_ip) as RemoteIPs by src_ip, process_name
| sort by ConnectionCount descSumo Logic query over firewall/netflow logs flagging non-mail-client processes connecting outbound on SMTP ports, using the native cidr() operator to exclude RFC1918 destination ranges. cidr() performs a genuine subnet-membership test against the parsed dst_ip field, unlike an 'in' list comparison against the CIDR string itself, which never matches a real IP address.
Data Sources
Required Tables
False Positives & Tuning
- Legacy line-of-business applications sending transactional email directly via SMTP
- Scripted automation and backup tooling emailing job-completion notifications via an approved relay
- Scan-to-email multi-function printers routing through a workstation-adjacent relay agent
Other platforms for THREAT-SMTP-Exfiltration
Testing Methodology
Validate this detection against 2 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1Simulated Direct SMTP Exfiltration Connection via PowerShell
Expected signal: Sysmon Event ID 3 (Network Connection): powershell.exe connecting to 127.0.0.1:587 (or the configured test relay). DeviceNetworkEvents: connection record with RemotePort=587, InitiatingProcessFileName=powershell.exe. If a local test SMTP listener (e.g. Python smtpd/aiosmtpd) is running to receive the session, its logs will show the EHLO, MAIL FROM, RCPT TO, and DATA commands with the synthetic credential payload.
- Test 2Periodic SMTP Beacon Simulation (Keylogger Exfil Interval Pattern)
Expected signal: Sysmon Event ID 1: update_helper.exe (a copy of powershell.exe) executing from %TEMP%\atomic_smtp_test\. Sysmon Event ID 3: three network connection events to 127.0.0.1:587 spaced ~5 seconds apart, initiated by the temp-directory binary.
References (5)
- https://attack.mitre.org/techniques/T1048/
- https://attack.mitre.org/techniques/T1048/003/
- https://www.fortinet.com/blog/threat-research/agent-tesla-old-cybercrime-rat-new-tricks
- https://www.cisecurity.org/insights/blog/top-10-malware-agent-tesla
- https://github.com/SigmaHQ/sigma/tree/master/rules/network
Response Playbook
Triage
- Identify the initiating process and determine whether it is a documented business application with a legitimate need to send email directly (check against an internal inventory of approved SMTP-sending applications).
- If the process is unrecognized, check its file hash, signature, and parent process chain — Agent Tesla, Formbook, and Snake Keylogger are typically delivered via phishing attachments (Office macros, ISO/IMG mounting) and run from user-writable directories (%APPDATA%, %TEMP%).
- Extract the destination IP and, if visible in a proxy or DPI log, the SMTP HELO/EHLO hostname and authenticated username — malware frequently hardcodes a free-tier Gmail, Yandex, or Mailtrap-style account for exfiltration.
- Correlate with DeviceFileEvents/Sysmon Event ID 11 for browser credential store reads, screenshot file creation, or keylog buffer writes in the minutes preceding the SMTP connection — the collect-then-mail pattern is near-universal for this malware family.
- If the connection succeeded (ConnectionSuccess) rather than failed, assume the data was successfully transmitted — SMTP is a synchronous request/response protocol and a successful connection with subsequent DATA command almost always means delivery.
- Check whether the same destination IP or account is contacted from other hosts in the environment, indicating a broader phishing or malvertising campaign rather than an isolated infection.
Containment
- Block the destination SMTP IP and, if identifiable, the associated domain at the perimeter firewall — this is effective because most stealers hardcode a small, static set of exfiltration mailboxes rather than rotating infrastructure.
- Isolate the affected endpoint via EDR network isolation, particularly if credential-store access was confirmed prior to the SMTP connection.
- Force credential rotation for every account with browser-saved or application-saved credentials on the host — assume total compromise of the local credential store.
- If the malware used a legitimate but compromised mailbox as its exfiltration relay (a common Agent Tesla pattern — abusing a small business's real SMTP account), notify that mailbox owner/provider so they can secure the account and it can be reported for abuse.
- Consider organization-wide egress filtering that restricts outbound SMTP (ports 25/465/587) to an approved list of mail relay IPs only, blocking direct-to-internet SMTP from standard endpoints — this single control defeats the entire technique class.
Evidence Collection
- Full network connection record (Sysmon Event ID 3 / DeviceNetworkEvents) for the SMTP session, including destination IP, port, and duration.
- If DPI/proxy visibility into port 25/587 exists, capture the SMTP transcript (HELO, AUTH, MAIL FROM, RCPT TO, DATA) — this directly reveals the sender/recipient mailbox and, unless TLS-wrapped, the exfiltrated content itself.
- The malware binary and its delivery artifact (phishing email, attachment, downloaded file) for family attribution.
- Browser credential store files and screenshot/keylog temp files created on the host to determine the scope of data collected before transmission.
- Any embedded configuration (often Base64 or XOR-obfuscated in the binary) containing the hardcoded SMTP server, port, username, and password — extractable via malware sandboxing or static analysis and reusable for takedown requests.
Escalation Criteria
- !Confirmed successful SMTP delivery (not just connection attempt) of a corporate credential store, VPN configuration, or cloud admin credentials — escalate to IAM for emergency rotation.
- !Malware family or infrastructure matches known targeted-intrusion tooling rather than a commodity stealer distribution campaign.
- !The affected host is a server, domain controller, or privileged workstation.
- !Multiple hosts show the same SMTP exfiltration destination or malware hash, indicating an organization-wide phishing campaign.
- !Evidence that the exfiltration mailbox itself belongs to a legitimate third-party business (compromised relay) rather than a throwaway adversary-registered account — this expands the incident to include that third party.
Investigation Guide
Related Techniques
Forensic Artifacts
- >
Sysmon Event ID 3 (Network Connection) / DeviceNetworkEvents for the outbound SMTP session with destination IP and port. - >
Proxy/DPI logs with SMTP protocol decoding, if available, capturing the full transcript including sender, recipient, and (if unencrypted) message body. - >
Malware configuration strings extracted via static/dynamic analysis, typically containing the SMTP host, port, username, and password. - >
Browser credential store and screenshot/keylog temp files on the host establishing what was collected prior to transmission. - >
Prefetch and Shimcache entries for the malware binary, useful for establishing first-execution time even if the binary has since been deleted.
Tuning Guidance
Build and maintain an explicit inventory of approved direct-SMTP-sending applications (billing systems, monitoring tools, scan-to-email appliances) and exclude them by process hash plus destination relay IP — excluding by process name alone is insufficient since malware can be named identically. Route all legitimate application email through a single approved internal relay where possible, which both reduces false positives and makes any direct-to-internet SMTP connection maximally suspicious. The user-writable-directory hunting query is typically the highest-precision addition to this pack; consider promoting it from a hunting query to a primary detection rule once your environment's legitimate SMTP-sending application inventory is fully documented and excluded. Any RFC1918/private-range exclusion added to a query in this pack must use the platform's CIDR range-match function (cidrmatch, ipv4_is_in_range, INCIDR, cidrMatch, ip_in_range_cidr, cidr()) — a plain string-equality IN/= comparison against a CIDR literal will never match an actual IP address and silently disables the exclusion.
Hunting Queries
Hunts for periodic, sub-2-hour-interval SMTP connections from the same process to the same destination — a pattern consistent with keyloggers that batch and email captured keystrokes/screenshots on a fixed schedule (e.g. Agent Tesla's configurable exfiltration interval) rather than a single legitimate transactional email.
// Hunt for repeated outbound SMTP connections at regular short intervals — indicates automated periodic keylog/screenshot exfil rather than a one-time email
DeviceNetworkEvents
| where Timestamp > ago(7d)
| where RemotePort in (25, 465, 587)
| where RemoteIPType == "Public"
| summarize ConnectionTimes = make_list(Timestamp), ConnectionCount = count()
by DeviceName, InitiatingProcessFileName, RemoteIP
| where ConnectionCount >= 3
| mv-expand ConnectionTimes to typeof(datetime)
| sort by DeviceName, InitiatingProcessFileName, ConnectionTimes asc
| serialize
| extend PrevTime = prev(ConnectionTimes)
| extend GapMinutes = datetime_diff('minute', ConnectionTimes, PrevTime)
| where GapMinutes > 0 and GapMinutes < 120
| summarize AvgGapMinutes = avg(GapMinutes), Occurrences = count() by DeviceName, InitiatingProcessFileName, RemoteIP
| where Occurrences >= 2
| sort by Occurrences descindex=firewall OR index=netflow (dest_port=25 OR dest_port=465 OR dest_port=587)
| sort 0 host, process_name, dest_ip, _time
| streamstats current=f last(_time) as PrevTime by host, process_name, dest_ip
| eval GapMinutes=(_time-PrevTime)/60
| where GapMinutes>0 AND GapMinutes<120
| stats avg(GapMinutes) as AvgGapMinutes, count as Occurrences by host, process_name, dest_ip
| where Occurrences>=2
| sort - OccurrencesHunts for SMTP connections originating from processes running out of user-writable or temporary directories — locations where legitimate mail clients and line-of-business applications essentially never execute from, but where phishing-delivered stealer payloads almost always land.
// Hunt for SMTP connections from processes running out of user-writable/temp directories
DeviceNetworkEvents
| where Timestamp > ago(7d)
| where RemotePort in (25, 465, 587)
| where RemoteIPType == "Public"
| where InitiatingProcessFolderPath has_any (dynamic(["\\AppData\\", "\\Temp\\", "\\Downloads\\", "\\ProgramData\\"]))
| project Timestamp, DeviceName, AccountName, InitiatingProcessFileName, InitiatingProcessFolderPath, RemoteIP, RemotePort
| sort by Timestamp descindex=firewall OR index=netflow (dest_port=25 OR dest_port=465 OR dest_port=587)
process_path="*\\AppData\\*" OR process_path="*\\Temp\\*" OR process_path="*\\Downloads\\*" OR process_path="*\\ProgramData\\*"
| table _time, host, user, process_name, process_path, dest_ip, dest_port
| sort - _timeAtomic Red Team Tests
Simulates an infostealer's exfiltration step by opening a raw TCP connection to port 587 (SMTP submission) on a test mail relay and issuing basic SMTP protocol commands (EHLO, AUTH, MAIL FROM, RCPT TO, DATA) carrying a synthetic credential payload, replicating the direct-SMTP-client pattern used by Agent Tesla and Formbook without requiring valid credentials or delivering real mail.
Command
$SmtpHost = '127.0.0.1'
$SmtpPort = 587
try {
$tcp = New-Object System.Net.Sockets.TcpClient
$tcp.Connect($SmtpHost, $SmtpPort)
$stream = $tcp.GetStream()
$writer = New-Object System.IO.StreamWriter($stream)
$writer.AutoFlush = $true
$writer.WriteLine("EHLO df00tech-atomic-test")
$writer.WriteLine("MAIL FROM:<[email protected]>")
$writer.WriteLine("RCPT TO:<[email protected]>")
$writer.WriteLine("DATA")
$writer.WriteLine("Subject: synthetic-credential-export`r`n`r`nuser=testuser`r`npass=synthetic-$(Get-Random)`r`n.")
Start-Sleep -Milliseconds 500
$tcp.Close()
} catch {}
Write-Host 'Atomic test complete: simulated direct SMTP exfiltration session generated'Expected Telemetry
Sysmon Event ID 3 (Network Connection): powershell.exe connecting to 127.0.0.1:587 (or the configured test relay). DeviceNetworkEvents: connection record with RemotePort=587, InitiatingProcessFileName=powershell.exe. If a local test SMTP listener (e.g. Python smtpd/aiosmtpd) is running to receive the session, its logs will show the EHLO, MAIL FROM, RCPT TO, and DATA commands with the synthetic credential payload.
Expected Detection
KQL/SPL detection flags powershell.exe as a non-mail-client process connecting on SMTP port 587 to a target outside the known mail-process allowlist. Adjust the test to target a non-loopback address (or add a loopback exception override for lab validation) since the production query excludes RFC1918/internal destinations by default.
Simulates the periodic batch-and-email behavior of keylogger-style malware (Agent Tesla, Snake Keylogger) by opening three SMTP connections spaced several seconds apart from a process running out of a user-writable temp-style directory, replicating both the periodicity hunting query and the temp-directory hunting query in this detection pack.
Command
$TestDir = "$env:TEMP\atomic_smtp_test"
New-Item -ItemType Directory -Path $TestDir -Force | Out-Null
Copy-Item "$env:SystemRoot\System32\WindowsPowerShell\v1.0\powershell.exe" "$TestDir\update_helper.exe" -ErrorAction SilentlyContinue
for ($i = 0; $i -lt 3; $i++) {
try {
$tcp = New-Object System.Net.Sockets.TcpClient
$tcp.Connect('127.0.0.1', 587)
$tcp.Close()
} catch {}
Start-Sleep -Seconds 5
}
Write-Host 'Atomic test complete: 3 periodic SMTP connections from temp-directory binary generated'Cleanup
Remove-Item "$env:TEMP\atomic_smtp_test" -Recurse -Force -ErrorAction SilentlyContinueExpected Telemetry
Sysmon Event ID 1: update_helper.exe (a copy of powershell.exe) executing from %TEMP%\atomic_smtp_test\. Sysmon Event ID 3: three network connection events to 127.0.0.1:587 spaced ~5 seconds apart, initiated by the temp-directory binary.
Expected Detection
The temp-directory hunting query flags update_helper.exe based on its InitiatingProcessFolderPath containing '\\Temp\\'. The periodicity hunting query detects the ~5-second (scaled down for lab testing; production threshold is sub-2-hour) regular interval between the three connections to the same destination.