SMTP on Port 26/TCPedit

Detects events that may indicate use of SMTP on TCP port 26. This port is commonly used by several popular mail transfer agents to deconflict with the default SMTP port 25. This port has also been used by a malware family called BadPatch for command and control of Windows systems.

Rule type: query

Rule indices:

  • filebeat-*

Severity: low

Risk score: 21

Runs every: 5 minutes

Searches indices from: now-6m (Date Math format, see also Additional look-back time)

Maximum signals per execution: 100



  • Elastic
  • Network

Version: 2 (version history)

Added (Elastic Stack release): 7.6.0

Last modified (Elastic Stack release): 7.6.1

Potential false positivesedit

Servers that process email traffic may cause false positives and should be excluded from this rule as this is expected behavior.

Rule queryedit

network.transport:tcp and destination.port:26

Threat mappingedit


Rule version historyedit

Version 2 (7.6.1 release)
  • Removed auditbeat-*, packetbeat-*, and winlogbeat-* from the rule indices.