Script host or signed proxy binary connecting to mail ports

Siemphony@siemphonymediumT1071.003unverifiedPlaybook · Command and control

AN0379's Windows leg reduced to what a single Sysmon EventID 3 record can carry: a scripting engine or signed proxy binary — never a mail client — opening an outbound connection to an SMTP, IMAP or POP3 service port. `Initiated`, `Image` and `DestinationPort` are all network-connection fields, so the whole selection evaluates on one event and no process-creation field is mixed in. It sees the connection and nothing of its contents, so it cannot separate mail-protocol C2 from a script that legitimately sends mail: MITRE's AttachmentType knob, and the outbound-to-inbound ratio idea AN0382 builds on, both need Zeek smtp.log, which this log source is not. The port list is MITRE's DestPortFilter knob populated here with the standard submission, relay and retrieval ports, and the process list is the ProcessImageName knob populated with script hosts and download-capable signed binaries. Requires Sysmon installed with network-connection logging enabled and not trimmed to a handful of ports — it is absent from a bare Windows install and filtered hard in most shipped configurations, so an empty result means blind, not clean. UNVERIFIED AS AUTHORED — derived from MITRE ATT&CK DET0135, not hand-written and not tested by its author. Any lab result is on this rule's own page.Full description

The 2 SIEM queries below are previews produced by Siemphony’s own translator, not pySigma, and none has been executed against a real backend — review before you deploy.

detection.yml

1title: Script host or signed proxy binary connecting to mail ports2id: 4fdb79ba-7a08-495f-a01f-9621f93c1ed73status: experimental4description: |5  AN0379's Windows leg reduced to what a single Sysmon EventID 3 record can6  carry: a scripting engine or signed proxy binary — never a mail client —7  opening an outbound connection to an SMTP, IMAP or POP3 service port.8  `Initiated`, `Image` and `DestinationPort` are all network-connection fields,9  so the whole selection evaluates on one event and no process-creation field10  is mixed in. It sees the connection and nothing of its contents, so it cannot11  separate mail-protocol C2 from a script that legitimately sends mail: MITRE's12  AttachmentType knob, and the outbound-to-inbound ratio idea AN0382 builds on,13  both need Zeek smtp.log, which this log source is not. The port list is14  MITRE's DestPortFilter knob populated here with the standard submission,15  relay and retrieval ports, and the process list is the ProcessImageName knob16  populated with script hosts and download-capable signed binaries. Requires17  Sysmon installed with network-connection logging enabled and not trimmed to a18  handful of ports — it is absent from a bare Windows install and filtered hard19  in most shipped configurations, so an empty result means blind, not clean.20  UNVERIFIED AS AUTHORED — derived from MITRE ATT&CK DET0135, not hand-written and not tested by its author. Any lab result is on this rule's own page.21references:22  - https://attack.mitre.org/techniques/T1071/00323  - https://attack.mitre.org/detectionstrategies/DET013524author: Siemphony pipeline (machine-derived from MITRE ATT&CK v19.2)25date: 2026-08-1626tags:27  - attack.command-and-control28  - attack.t1071.00329logsource:30  category: network_connection31  product: windows32detection:33  selection:34    Initiated: 'true'35    Image|endswith:36      - '\powershell.exe'37      - '\pwsh.exe'38      - '\wscript.exe'39      - '\cscript.exe'40      - '\mshta.exe'41      - '\rundll32.exe'42      - '\regsvr32.exe'43      - '\certutil.exe'44      - '\curl.exe'45      - '\python.exe'46    DestinationPort:47      - 2548      - 46549      - 58750      - 11051      - 99552      - 14353      - 99354  condition: selection55falsepositives:56  - "Administrative and monitoring scripts that send mail. Send-MailMessage and the .NET SmtpClient are the ordinary way a scheduled PowerShell job reports a backup result or a disk-space alert, and the resulting event is a script host talking to port 25 or 587 — exactly the tuple selected here. In most estates this is the single largest source of hits and it has to be baselined by account and destination before the rule is worth alerting on."57  - "Python-based agents and line-of-business tooling bundled with their own interpreter, which show up as python.exe reaching a mail relay on a fixed schedule from a small set of servers."58  - "curl.exe is shipped in Windows and is a supported mail client, so any integration or CI step that posts to an IMAPS or SMTPS endpoint with it matches without anything unusual happening."59  - "Mail relays and connectors reached over the retrieval ports by inventory or migration utilities during a mailbox move, which is rare but produces a burst rather than a single event."60level: medium

Splunk · SPL

Run this as a search.

index=* (Initiated="true" AND (Image="*\\powershell.exe" OR Image="*\\pwsh.exe" OR Image="*\\wscript.exe" OR Image="*\\cscript.exe" OR Image="*\\mshta.exe" OR Image="*\\rundll32.exe" OR Image="*\\regsvr32.exe" OR Image="*\\certutil.exe" OR Image="*\\curl.exe" OR Image="*\\python.exe") AND (DestinationPort="25" OR DestinationPort="465" OR DestinationPort="587" OR DestinationPort="110" OR DestinationPort="995" OR DestinationPort="143" OR DestinationPort="993"))

Wazuh · XML rule

Deploy to your manager — this is a rule, not a search.

<group name="sigma,windows,network_connection,">  <!-- Rule ids must be unique on your manager; 100000+ is the user range. -->  <rule id="100000" level="7">    <!-- Set <if_sid> to the decoder/base rule for windows so this only evaluates relevant events. -->    <field name="Initiated" type="pcre2">(?i)^true$</field>    <field name="Image" type="pcre2">(?i)(\\powershell\.exe$|\\pwsh\.exe$|\\wscript\.exe$|\\cscript\.exe$|\\mshta\.exe$|\\rundll32\.exe$|\\regsvr32\.exe$|\\certutil\.exe$|\\curl\.exe$|\\python\.exe$)</field>    <field name="DestinationPort" type="pcre2">(?i)(^25$|^465$|^587$|^110$|^995$|^143$|^993$)</field>    <description>Script host or signed proxy binary connecting to mail ports</description>    <mitre>      <id>T1071.003</id>    </mitre>  </rule></group>

Sentinel · KQL

Run this as a search.

Sentinel cannot express this construct. `Initiated` has no Sentinel column: Defender expresses connection direction in `ActionType`, not as a boolean column, so `Initiated` cannot be renamed — it needs a different predicate. The Sigma source is on the first tab, unchanged.

Elastic · ES|QL

Run this as a search.

Elastic cannot express this construct. `Initiated` has no ECS field: ECS expresses connection direction as `network.direction` with values like `egress`, not as a boolean, so `Initiated` needs a different predicate rather than a rename. The Sigma source is on the first tab, unchanged.

At a glance

Logsource: network_connection / windows
Level: medium
Category: reverse_shell
Sigma status: experimental
Backends: 2 of 4 rendered
Updated: 30 Aug 2026
Rule ID: 4fdb79ba-7a08-495f-a01f-9621f93c1ed7

ATT&CKT1071.003

T1071.003Mail Protocols

ATT&CK® is a registered trademark of The MITRE Corporation. These mappings are the rule author’s, and are neither reviewed nor endorsed by MITRE.

Evidence

Verification1 run

Not verified

Siemphony benign baseline
completed
Siemphony IR · 3 Sept 2026
No events matched, so this run proves nothing either way.

Noise check0 of 2 fired

Fires on none of the 2 ordinary behaviours the baseline holds for this log type. That is not a precision guarantee: it means only not caught by these 2 behaviours, and the next ordinary behaviour nobody wrote down may still match.

Run live against 65 hand-written events of ordinary corporate activity — backup agents, software distribution, patching, helpdesk scripts, EDR. It says nothing about how often the rule would fire in production, which is the number that actually exhausts an analyst.

Test it yourselfin your browser

Runs here in your browser against public attack recordings. A preview — not the verification badge.

Recordings of T1071.003, evaluated against their network_connection events.

Using it

Tuning & false positivesexperimental · 4 declared

experimental (current stage)
test
stable

Written and reasoned about, but not yet run against real telemetry. Expect to tune it before trusting it.

Tuning tips

Add the destination gate first. A commented filter_internal_relay on
Baseline by account and destination before routing anywhere near a queue.
\python.exe catches every virtualenv and vendor-bundled interpreter; put it
The framing that scales is the inverse: any process reaching a mail port that

Declared by the author

Administrative and monitoring scripts that send mail. Send-MailMessage and the .NET SmtpClient are the ordinary way a scheduled PowerShell job reports a backup result or a disk-space alert, and the resulting event is a script host talking to port 25 or 587 — exactly the tuple selected here. In most estates this is the single largest source of hits and it has to be baselined by account and destination before the rule is worth alerting on.
Python-based agents and line-of-business tooling bundled with their own interpreter, which show up as python.exe reaching a mail relay on a fixed schedule from a small set of servers.
curl.exe is shipped in Windows and is a supported mail client, so any integration or CI step that posts to an IMAPS or SMTPS endpoint with it matches without anything unusual happening.
Mail relays and connectors reached over the retrieval ports by inventory or migration utilities during a mailbox move, which is rare but produces a burst rather than a single event.

Lessonreverse shell

reverse shellAI draft — unreviewed

01 · What this rule detects

An interpreter or signed proxy binary — never a mail client — opening an outbound connection to an SMTP, IMAP or POP3 service port. MITRE's analytic AN0379 describes mail-protocol C2: a beacon hiding inside traffic every enterprise already carries. The rule reduces AN0379's Windows leg to what a single Sysmon EventID 3 record can carry. It sees a connection and nothing of its contents, so it cannot tell C2 from a script that genuinely sends mail. The two ideas that could — MITRE's AttachmentType knob and the outbound-to-inbound ratio AN0382 is built on — both need Zeek smtp.log, a different log source in the same strategy.

02 · Telemetry you need

Sysmon EventID 3, mapped to network_connection. Network-connection logging is
All three fields — Initiated, Image, DestinationPort — live on EventID 3,
translations.json records a Sentinel refusal: Defender expresses direction in

03 · How the logic works

Three AND-ed conditions. Initiated: 'true' keeps outbound connections only. The port list is MITRE's DestPortFilter knob populated with the standard submission, relay and retrieval ports; the image list is MITRE's ProcessImageName knob — MITRE names PowerShell and rundll32, the rest are authored. The rule has no gate on the destination, and that is its central weakness. Ports 25/587 are not suspicious; the process is doing all the work. But a PowerShell job connecting to 127.0.0.1:25 or to the company's own relay matches byte-for-byte what a beacon reaching an attacker's MX produces. The one fact that separates mail C2 from mail sending is the destination not being enterprise mail infrastructure — and MITRE names a knob for exactly that, ExternalMailRelayFilter under AN0382. It is not represented here, not even as a commented filter. On any host running a local relay, this rule alerts on ordinary operations all day. Two more things review surfaced. First, check the binary is what the log source records. The reviewer found \bitsadmin.exe in an earlier draft: BITS transfers are performed by the BITS service inside svchost.exe, so bitsadmin.exe never opens the socket — and BITS speaks HTTP and SMB only, so the value was dead twice over. It is gone from the list you see. certutil.exe is the weaker version of the same problem: -urlcache is HTTP-only, so certutil.exe on port 25 is only reachable if injected code inside it opened the socket. Keep it for that reason, not because certutil speaks mail. Second, the image list is the entire detection. Any implant not among those ten names is invisible: a compiled beacon, a renamed powershell.exe, code injected into outlook.exe. Most real mail-protocol C2 is a custom binary rather than a LOLBin, so this rule covers MITRE's stated analytic but not the technique's centre of mass.

04 · Common false positives

Scripts that send mail. Send-MailMessage and the .NET SmtpClient are the
The pre-PowerShell version, which the false positives do not name: **legacy
Python agents bundled with their own interpreter, hitting a relay on schedule.
curl.exe ships in Windows and is a supported mail client; any CI step posting

05 · Detection maturity

tier_1: .** UNVERIFIED — derived from MITRE ATT&CK DET0135 and never executed against a single log line. level: medium against an admitted largest-source-of- hits is already on the edge.
tier_2: means running it over historical EventID 3 data and populating the destination filter.
tier_3: needs the Zeek legs — session contents, attachment types, the outflow-to-inflow ratio — which no network_connection rule can reach.

Related detections6 nearby

Ranked by how alike the detection logic reads, computed offline. Proximity is not evidence — each of these carries its own verification state on its own page.

Share this rule

/u/siemphony/4fdb79ba-7a08-495f-a01f-9621f93c1ed7

More from this repertoire

All compositions

Verdicts · reactions · comments

Community

Verdicts from engineers who actually deployed it, and the conversation around it.

Not yet reported on

Nobody has run this in a real environment and said what happened.

Verdicts from engineers who deployed it

0 cast

No verdicts reported yet. The first one is worth more than the tenth — say what you ran it against.

No comments yet. Someone who deploys this will have something to say about it.

Script host or signed proxy binary connecting to mail ports

The detection

detection.yml

Splunk · SPL

Wazuh · XML rule

Sentinel · KQL

Elastic · ES|QL

Community

Verdicts from engineers who deployed it