IMPORTANT: No additional bug fixes or documentation updates
will be released for this version. For the latest information, see the
current release documentation.
SMTP on Port 26/TCP
editSMTP on Port 26/TCP
editThis rule detects events that may indicate use of SMTP on TCP port 26. This port is commonly used by several popular mail transfer agents to deconflict with the default SMTP port 25. This port has also been used by a malware family called BadPatch for command and control of Windows systems.
Rule type: query
Rule indices:
- packetbeat-*
- auditbeat-*
- filebeat-*
- logs-network_traffic.*
Severity: low
Risk score: 21
Runs every: 5m
Searches indices from: now-9m (Date Math format, see also Additional look-back time)
Maximum alerts per execution: 100
References:
Tags:
- Tactic: Command and Control
- Domain: Endpoint
- Use Case: Threat Detection
Version: 103
Rule authors:
- Elastic
Rule license: Elastic License v2
Rule query
edit(event.dataset: network_traffic.flow or (event.category: (network or network_traffic))) and
network.transport:tcp and (destination.port:26 or (event.dataset:zeek.smtp and destination.port:26))
Framework: MITRE ATT&CKTM
-
Tactic:
- Name: Command and Control
- ID: TA0011
- Reference URL: https://attack.mitre.org/tactics/TA0011/
-
Tactic:
- Name: Exfiltration
- ID: TA0010
- Reference URL: https://attack.mitre.org/tactics/TA0010/
-
Technique:
- Name: Exfiltration Over Alternative Protocol
- ID: T1048
- Reference URL: https://attack.mitre.org/techniques/T1048/