tfMITRE ATT&CK sub-technique

Mail Protocols T1071.003

sub-technique of T1071 Application Layer Protocol

Tactic: Command and Control
Platforms: Linux, macOS, Network Devices, Windows
Version: 1.2
Created: 15 March 2020
Last modified: 24 October 2025
Contributor: Don Le, Stifel Financial

Adversaries may communicate using application layer protocols associated with electronic mail delivery to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.

ReconResource DevInitial AccessExecutionPersistencePriv EscStealthDef ImpairmentCred AccessDiscoveryLateral MoveCollectionC2ExfiltrationImpact

Threat groupsTop 25%

Threat groups75th percentile · 75% of ATT&CK techniques have this many threat groups attributed or fewer.

CampaignsNone recorded

CampaignsNone recorded · 54% of ATT&CK techniques have none either.

Tools & malwareTop 17%

Tools & malware83rd percentile · 83% of ATT&CK techniques have this many tools implementing them or fewer.

Detection rules54th pct

Detection rules54th percentile · 54% of ATT&CK techniques have this many detection rules written or fewer.

Mail Protocols MITRE reference T1071.003

Top 25%of all ATT&CK techniques for number of groups

6 groups have been recorded using this technique. Newest first; each entry carries MITRE’s procedure text and a link to the group’s full record. Click a name to filter the rules below.

Contagious InterviewG1052 ↗

Has utilized email notifications from malware distribution servers to track victim engagement.1

created 2025-10-191 referenceaka DeceptiveDevelopment

KimsukyG0094 ↗

Has used e-mail to send exfiltrated data to C2 servers.1

created 2019-08-261 referenceaka Black Banshee

SilverTerrierG0083 ↗

Uses SMTP for C2 communications.1

created 2019-01-291 reference

APT32G0050 ↗

Has used email for C2 via an Office macro.1 2

created 2017-12-142 referencesaka SeaLotus

TurlaG0010 ↗

Has used multiple backdoors which communicate with a C2 server via email attachments.1

created 2017-05-311 referenceaka IRON HUNTER

APT28G0007 ↗

Has used IMAP, POP3, and SMTP for a communication channel in various implants, including using self-registered Google Mail accounts and later compromised email servers of its victims.1 2

created 2017-05-312 referencesaka IRON TWILIGHT

All 6 groups for this technique

Offense vs defense T1071.003

Is defensive coverage keeping up with adversary use? Eight counts, each ranked against all 697 ATT&CK techniques. Attack sits left, defense right, so a shape leaning left means adversaries are better documented here than defenders are equipped. Hover any spoke for its percentile and the share of techniques that have more. The timeline below shows when each side arrived.

How it got here

Range

Adversary activity (campaign spans) over cumulative rule output. Each source is plotted independently from zero, so neither line includes the other. Campaign dates are year-granularity.

Campaigns · 0Sigma rules (cumulative) · 0Splunk ESCU (cumulative) · 3

first rule: 2022 Q3

Mail Protocols detection strategy DET0135

MITRE names one behaviour worth catching for this technique and breaks it into 4 analytics, one per platform. Each carries the log sources it needs and the fields you tune per environment.

Detection of Mail Protocol-Based C2 Activity (SMTP, IMAP, POP3)

Enterprise

4 platforms

AN0379 · Windows

Detects unauthorized use of SMTP/IMAP/POP3 by suspicious binaries (e.g., PowerShell, rundll32) to exfiltrate data or beacon via email, often bypassing proxy or content filters.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
Process CreationDC0032	WinEventLog:Sysmon	EventCode=1
Network Connection CreationDC0082	WinEventLog:Sysmon	EventCode=3, 22
Network Traffic ContentDC0085	NSM:Flow	smtp.log

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
ProcessImageName	Limit to uncommon clients (e.g., scripts or CLI tools using .NET SMTP libraries)
DestPortFilter	Typically 25, 587, 993, 995, or 465 – flag anomalies
AttachmentType	Flag suspicious attachments (e.g., .zip, .7z, .bin)

AN0380 · Linux

Detects non-interactive or script-driven email transmission using tools like sendmail, mailx, or custom SMTP scripts by background processes, especially when sending attachments or large payloads.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
Process CreationDC0032	auditd:SYSCALL	execve
Network Traffic ContentDC0085	NSM:Flow	smtp.log, conn.log

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
TransferSizeThreshold	Bytes transferred via SMTP session
ScriptNameFilter	e.g., base64 encoded mailer scripts or one-liners in cron

AN0381 · macOS

Detects email-sending behavior via Terminal, AppleScript, or Automator that interfaces with SMTP or IMAP, typically using curl or mail-related APIs in unsanctioned contexts.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
Process CreationDC0032	macos:unifiedlog	log stream --predicate 'processImagePath CONTAINS "curl" OR "osascript"'
Network Traffic FlowDC0078	macos:osquery	socket_events

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
UserContext	Monitor non-mail client users initiating SMTP/IMAP
TimeWindow	Look for execution of mail commands during off-hours

AN0382 · Network Devices

Detects hosts transmitting large volumes of SMTP, IMAP, or POP3 traffic to external IPs or relays that aren't associated with the enterprise mail infrastructure.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
Network Traffic ContentDC0085	NSM:Flow	smtp.log, conn.log

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
ExternalMailRelayFilter	Dest IPs not matching sanctioned SMTP/IMAP relays
OutflowToInflowRatio	Outbound email bytes vastly exceed response

Mail Protocols detections T1071.003

3 rules are mapped to this technique. Parent techniques also include their sub-techniques’ rules. Click a slice or key entry to filter the table.

54th pctamong all ATT&CK techniques for number of rules

Product

Severity

Library

Drag headers to reorder | Drag edges to resize

Loading detections...

Select	Title	Description	Category	Status	Event	Product	MITRE ATT&CK	CVEs	Severity	Author	Created	Updated	ID	Refs