Analytics Low
✕

Large Upload (SMTP)

The endpoint, which is not an internal SMTP server, emailed an excessive amount of data from your network.

Module:
Platform Analytics
Data source:
Palo Alto Networks Firewall traffic Logs, XDR Agent, Third-Party Firewalls
ATT&CK tactics: Exfiltration (TA0010)
ATT&CK techniques: Exfiltration Over Alternative Protocol (T1048)
Attacker's goals:

Transfer data they have stolen from your network to a location that is convenient and useful to him.

Investigative actions:

Identify the process/user performing the data transfer to determine if the transfer is sanctioned. Verify that the source is not a mail server. Check if the target address represents a mail service that rarely used in the organization. If so, this might indicate on file exfiltration attempt.

Test period:
1 Day
Deduplication:
1 Day
1 variation:
  • Large Upload (SMTP) Informational (parent: Low)