T1667 · Email Bombing · MITRE ATT&CK

Email Bombing MITRE reference T1667

45th pctamong all ATT&CK techniques for number of groups

1 group has been recorded using this technique. Newest first; each entry carries MITRE’s procedure text and a link to the group’s full record. Click a name to filter the rules below.

Storm-1811G1046 ↗

Has deployed large volumes of non-malicious email spam to victims in order to prompt follow-on interactions with the threat actor posing as IT support or helpdesk to resolve the problem.1 2

created 2025-03-142 references

All 1 groups for this technique

Offense vs defense T1667

Compare defenses against adversary use. Eight counts, ranking this technique against the entire ATT&CK Enterprise matrix. Attack sits left, defense right.

Email Bombing detection strategy DET0355

MITRE names one behaviour worth catching for this technique and breaks it into 4 analytics, one per platform. Each carries the log sources it needs and the fields you tune per environment.

Detection Strategy for Email Bombing

Enterprise

4 platforms

AN1008 · Windows

Detect abnormally high volume of inbound email messages or repetitive attachments being delivered to a single mailbox within a short time window. Defenders should look for anomalous spikes in message counts and repetitive attachment file creation events correlated with targeted users.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
Application Log ContentDC0038	m365:unified	Send/Receive: Unusual spikes in inbound messages to a single recipient
File CreationDC0039	WinEventLog:Sysmon	EventCode=11

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
TimeWindow	Defines the aggregation interval (e.g., 5 minutes, 1 hour) for detecting spikes in inbound email traffic.
RecipientThreshold	Defines maximum number of acceptable messages per user before triggering anomaly.
AttachmentSizeThreshold	Defines the size threshold for repetitive attachments to be flagged.

AN1009 · Linux

Monitor mail server logs (e.g., Postfix, Sendmail) for excessive connections or inbound message counts targeting a single recipient. Correlate with repetitive attachment storage in /var/mail or /var/spool/mail directories.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
Application Log ContentDC0038	Application:Mail	High-frequency inbound mail activity to a specific recipient address
File CreationDC0039	auditd:SYSCALL	File creation events in /var/mail or /var/spool/mail exceeding baseline thresholds

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
MailVolumeThreshold	Tunable value for the maximum acceptable emails per minute per user.
AttachmentPatternList	List of suspicious attachment extensions that may be abused for repetitive delivery.

AN1010 · Office Suite

Detect abnormal use of email clients (e.g., Outlook, Thunderbird) showing mass arrival of messages or repetitive attachments being locally stored. Correlate message volume with file creation activity in mail cache directories.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
Application Log ContentDC0038	m365:exchange	MailDelivery: High-frequency delivery of messages or attachments to a single recipient

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
UserContext	Context for distinguishing between VIP or sensitive recipients and general users.

AN1011 · macOS

Monitor unified logs and Mail.app activity for repetitive incoming messages with attachments. Defenders should look for large volumes of incoming mail stored under ~/Library/Mail with unusual timing or repetitive subjects.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
Application Log ContentDC0038	macos:unifiedlog	Repetitive inbound email delivery activity logged within a short time window
File CreationDC0039	fs:fsusage	create: Attachment file creation in ~/Library/Mail directories

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
FileCountThreshold	Threshold for repetitive attachment files created within a defined interval.

Email Bombing detections T1667

No detection rules are mapped to this technique yet.

None recorded— 32% of ATT&CK techniques have none either

No matching rules

Drag headers to reorder | Drag edges to resize

Select	Title	Description	Category	Status	Event	OS	Product	MITRE ATT&CK	CVEs	Severity	Author	Created	Updated	ID	Refs
No rules found. Try adjusting your filters.

Email Bombing T1667

Email Bombing T1667

Email Bombing MITRE reference T1667

Offense vs defense T1667

Email Bombing detection strategy DET0355

Detection Strategy for Email Bombing

Log sources

Tunable fields

Log sources

Tunable fields

Log sources

Tunable fields

Log sources

Tunable fields

Email Bombing MITRE reference T1667

Offense vs defense T1667

Email Bombing detection strategy DET0355

Detection Strategy for Email Bombing

Log sources

Tunable fields

Log sources

Tunable fields

Log sources

Tunable fields

Log sources

Tunable fields

Email Bombing detections T1667

Email Bombing detections T1667