Mail Protocols (MITRE ATT&CK T1071.003) is a Command and Control technique. MITRE lists Linux, macOS, network devices and Windows as platforms.
Adversaries use the protocols that deliver electronic mail to blend in with normal traffic. Commands to the remote system, and often the results, are embedded in that traffic.
How attackers use it
MITRE names SMTP/S, POP3/S and IMAP as examples. They are common in most environments, their packets have many fields and headers where data can be hidden, and data can also be concealed in the email messages themselves. An adversary can use them to talk to systems under their control while looking like normal mail flow.
How to detect it
MITRE's detection strategy has four analytics:
- Windows: unauthorized SMTP, IMAP or POP3 use by suspicious binaries such as PowerShell or rundll32, to exfiltrate data or beacon through email, often getting around proxy or content filters.
- Linux: non-interactive or script-driven email sent through tools such as sendmail, mailx or custom SMTP scripts by background processes, especially with attachments or large payloads.
- macOS: email sending from Terminal, AppleScript or Automator that talks to SMTP or IMAP, typically using curl or mail-related APIs in unsanctioned contexts.
- Network devices: hosts sending large volumes of SMTP, IMAP or POP3 to external IPs or relays that are not part of your mail infrastructure.
Data to gather: flow records for ports 25, 465, 587, 143, 993, 110 and 995, endpoint network telemetry that names the process, and mail gateway logs. The question to ask of each host is simple: should this host send mail at all?
How to reduce the risk
MITRE lists two mitigations:
- Filter network traffic. Limit the ability of servers and critical systems to start outbound email connections. Filter SMTP, IMAP and POP3 to trusted mail servers only, which lowers the risk of attackers using compromised systems to exfiltrate data by email or receive commands from attacker-controlled email accounts.
- Network intrusion prevention. Use signature-based systems to identify traffic from specific adversary malware.
Check your own environment
# Linux: connections to mail ports with owning process (read only)
sudo ss -tnp state established '( dport = :25 or dport = :465 or dport = :587 or dport = :993 )'
Then list which hosts have an approved reason to send mail, and confirm that all other hosts are blocked from external mail ports.
Quick check
What is the simplest preventive control for mail protocol C2?
Only let designated mail servers and relays make outbound mail connections, and block the rest, as MITRE's filter network traffic mitigation describes.
