T1667No distinct observable

Email Bombing

ImpactLinux, Office Suite, Windows, macOS

Where this stands

A reviewer read the telemetry and concluded there is nothing here to detect that a sibling technique does not already cover.

Email bombing is a quantity, not an event. What distinguishes it from ordinary mail is how many messages arrived at one mailbox in a window, and every analytic in DET0355 states the discriminator as a threshold over a count: AN1008 asks for 'abnormally high volume... within a short time window', AN1009 for 'file creation events in /var/mail or /var/spool/mail exceeding baseline thresholds', AN1011 for 'large volumes of incoming mail'. Every mutable element MITRE offers is that same threshold — TimeWindow and RecipientThreshold on AN1008, MailVolumeThreshold on AN1009, FileCountThreshold on AN1011. lib/sigma models no count aggregation and no timeframe, so the one property that defines the technique cannot be written. What is left is the per-event artefact, and in each analytic that artefact is precisely what a single legitimate email produces. […]

What the technique is

Adversaries may flood targeted email addresses with an overwhelming volume of messages. This may bury legitimate emails in a flood of spam and disrupt business operations. An adversary may accomplish email bombing by leveraging an automated bot to register a targeted address for e-mail lists that do not validate new signups, such as online newsletters. The result can be a wave of thousands of e-mails that effectively overloads the victim’s inbox. By sending hundreds or thousands of e-mails in quick succession, adversaries may successfully divert attention away from and bury legitimate messages including security alerts, daily business processes like help desk tickets and client correspondence, or ongoing scams. This behavior can also be used as a tool of harassment. This behavior may be a precursor for Spearphishing Voice. For example, an adversary may email bomb a target and then follow up with a phone call to fraudulently offer assistance. This social engineering may lead to the use of Remote Access Software to steal credentials, deploy ransomware, conduct Financial Theft, or engage in other malicious activity.

Read it on attack.mitre.org

What MITRE says you would watch

AN1008
Detect abnormally high volume of inbound email messages or repetitive attachments being delivered to a single mailbox within a short time window. Defenders should look for anomalous spikes in message counts and repetitive attachment file creation events correlated with targeted users.
AN1009
Monitor mail server logs (e.g., Postfix, Sendmail) for excessive connections or inbound message counts targeting a single recipient. Correlate with repetitive attachment storage in /var/mail or /var/spool/mail directories.
AN1010
Detect abnormal use of email clients (e.g., Outlook, Thunderbird) showing mass arrival of messages or repetitive attachments being locally stored. Correlate message volume with file creation activity in mail cache directories.