kqlElastic-2.0from elastic/detection-rules

SMTP on Port 26/TCP

Quality

FP risk

—

Forks

Views

ATT&CK techniques

T1071 T1071.003 T1571 T1048

Rule sourcerules/network/command_and_control_port_26_activity.toml

(data_stream.dataset: (network_traffic.flow or zeek.smtp) or event.category:(network or network_traffic)) and network.transport:tcp and destination.port:26