servers that process email traffic may cause false positives and should be excluded from this rule as this is expected behavior.

t1048
network
elastic

Techniques

T1048

Sample rules

SMTP on Port 26/TCP

source: elastic
technicques:
- T1048

Description

This rule detects events that may indicate use of SMTP on TCP port 26. This port is commonly used by several popular mail transfer agents to deconflict with the default SMTP port 25. This port has also been used by a malware family called BadPatch for command and control of Windows systems.

Detection logic

(event.dataset: (network_traffic.flow or zeek.smtp) or event.category:(network or network_traffic)) and network.transport:tcp and destination.port:26