SMTP on Port 26/TCP

edit

This rule detects events that may indicate use of SMTP on TCP port 26. This port is commonly used by several popular mail transfer agents to deconflict with the default SMTP port 25. This port has also been used by a malware family called BadPatch for command and control of Windows systems.

Rule type: query

Rule indices:

  • packetbeat-*
  • auditbeat-*
  • filebeat-*
  • logs-network_traffic.*

Severity: low

Risk score: 21

Runs every: 5m

Searches indices from: now-9m (Date Math format, see also Additional look-back time)

Maximum alerts per execution: 100

References:

Tags:

  • Tactic: Command and Control
  • Domain: Endpoint
  • Use Case: Threat Detection

Version: 103

Rule authors:

  • Elastic

Rule license: Elastic License v2

Rule query

edit
(event.dataset: network_traffic.flow or (event.category: (network or network_traffic))) and
    network.transport:tcp and (destination.port:26 or (event.dataset:zeek.smtp and destination.port:26))

Framework: MITRE ATT&CKTM