SMTP on Port 26/TCPedit

This rule detects events that may indicate use of SMTP on TCP port 26. This port is commonly used by several popular mail transfer agents to deconflict with the default SMTP port 25. This port has also been used by a malware family called BadPatch for command and control of Windows systems.

Rule type: query

Rule indices:

  • packetbeat-*
  • logs-network_traffic.*

Severity: low

Risk score: 21

Runs every: 5m

Searches indices from: now-9m (Date Math format, see also Additional look-back time)

Maximum alerts per execution: 100



  • Tactic: Command and Control
  • Domain: Endpoint
  • Use Case: Threat Detection

Version: 102

Rule authors:

  • Elastic

Rule license: Elastic License v2

Rule queryedit

event.dataset: network_traffic.flow and network.transport:tcp and (destination.port:26 or (event.dataset:zeek.smtp and destination.port:26))