sublimemediumRule

Spam: SMTP & Proxy Communications in Email Body

An email containing SMTP and Proxy (socks5) command and control information within the body of the message.

MITRE ATT&CK

Detection Query

type.inbound
and length(attachments) == 0
and 1 < length(body.links) < 5
and regex.icontains(body.current_thread.text,
                    '(?:\:socks5:|::127.0.0.1:1080|:0:127.0.0.1:1080)'
)

Data Sources

Email MessagesEmail HeadersEmail Attachments

Platforms

Raw Content

name: "Spam: SMTP & Proxy Communications in Email Body"
description: |
  An email containing SMTP and Proxy (socks5) command and control information within the body of the message.
type: "rule"
severity: "medium"
source: |
  type.inbound
  and length(attachments) == 0
  and 1 < length(body.links) < 5
  and regex.icontains(body.current_thread.text,
                      '(?:\:socks5:|::127.0.0.1:1080|:0:127.0.0.1:1080)'
  )
attack_types:
  - "Spam"
tactics_and_techniques:
  - "Free email provider"
detection_methods:
  - "Content analysis"
id: "2bdc6a3b-1239-5644-b4bc-d31666ded22e"