---
title: SMTP to the Internet
description: This rule detects events that may describe SMTP traffic from internal hosts to a host across the Internet. In an enterprise network, there is typically...
url: https://www.elastic.co/docs/reference/security/prebuilt-rules/rules/_deprecated/command_and_control_smtp_to_the_internet
products:
  - Elastic Security
---

# SMTP to the Internet
<warning>
  This rule has been deprecated as of 2021/04/15.
</warning>

This rule detects events that may describe SMTP traffic from internal hosts to a host across the Internet. In an
enterprise network, there is typically a dedicated internal host that performs this function. It is also frequently
abused by threat actors for command and control, or data exfiltration.
**Rule type**: query
**Rule indices**:
- filebeat-*
- packetbeat-*
- logs-endpoint.events.*

**Rule Severity**: low
**Risk Score**: 21
**Runs every**: 
**Searches indices from**: `now-9m`
**Maximum alerts per execution**: 100
**References**:
**Tags**:
- Elastic
- Host
- Network
- Threat Detection
- Command and Control

**Version**: 100
**Rule authors**:
- Elastic

**Rule license**: Elastic License v2

## Rule Query

```kuery
event.category:(network or network_traffic) and network.transport:tcp and (destination.port:(25 or 465 or 587) or event.dataset:zeek.smtp) and
  source.ip:(
    10.0.0.0/8 or
    172.16.0.0/12 or
    192.168.0.0/16
  ) and
  not destination.ip:(
    10.0.0.0/8 or
    127.0.0.0/8 or
    169.254.0.0/16 or
    172.16.0.0/12 or
    192.168.0.0/16 or
    224.0.0.0/4 or
    "::1" or
    "FE80::/10" or
    "FF00::/8"
  )
```

**Framework:** MITRE ATT&CK
- Tactic:
  - Name: Command and Control
  - Id: TA0011
  - Reference URL: [[https://attack.mitre.org/tactics/TA0011/](https://attack.mitre.org/tactics/TA0011/)](https://attack.mitre.org/tactics/TA0011/)

**Framework:** MITRE ATT&CK
- Tactic:
  - Name: Exfiltration
  - Id: TA0010
  - Reference URL: [[https://attack.mitre.org/tactics/TA0010/](https://attack.mitre.org/tactics/TA0010/)](https://attack.mitre.org/tactics/TA0010/)
- Technique:
  - Name: Exfiltration Over Alternative Protocol
  - Id: T1048
  - Reference URL: [[https://attack.mitre.org/techniques/T1048/](https://attack.mitre.org/techniques/T1048/)](https://attack.mitre.org/techniques/T1048/)