Esc
Mail Protocols - T1071.003

(ATT&CK® Technique)
Definition

Adversaries may communicate using application layer protocols associated with electronic mail delivery to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
D3FEND Inferred Relationships

Browse the D3FEND knowledge graph by clicking on the nodes below.
        graph LR;

     T1071003["Mail Protocols"] --> |produces| OutboundInternetMailTraffic["Outbound Internet Mail Traffic"]; class T1071003 OffensiveTechniqueNode;
        class OutboundInternetMailTraffic ArtifactNode; click OutboundInternetMailTraffic href "/dao/artifact/d3f:OutboundInternetMailTraffic";
        click T1071003 href "/offensive-technique/attack/T1071.003/"; click OutboundInternetMailTraffic href "/dao/artifact/d3f:OutboundInternetMailTraffic";          T1071003["Mail Protocols"] --> |may-transfer| CertificateFile["Certificate File"]; class T1071003 OffensiveTechniqueNode;
        class CertificateFile ArtifactNode; click CertificateFile href "/dao/artifact/d3f:CertificateFile";
        click T1071003 href "/offensive-technique/attack/T1071.003/"; click CertificateFile href "/dao/artifact/d3f:CertificateFile"; T1071003["Mail Protocols"] --> |produces| OutboundInternetNetworkTraffic["Outbound Internet Network Traffic"]; class T1071003 OffensiveTechniqueNode;
        class OutboundInternetNetworkTraffic ArtifactNode; click OutboundInternetNetworkTraffic href "/dao/artifact/d3f:OutboundInternetNetworkTraffic";
        click T1071003 href "/offensive-technique/attack/T1071.003/"; click OutboundInternetNetworkTraffic href "/dao/artifact/d3f:OutboundInternetNetworkTraffic";    PerHostDownload-UploadRatioAnalysis["Per Host Download-Upload Ratio Analysis"] -->
          | analyzes | OutboundInternetMailTraffic["Outbound Internet Mail Traffic"];

          PerHostDownload-UploadRatioAnalysis["Per Host Download-Upload Ratio Analysis"] -.->
            | may-detect | T1071003["Mail Protocols"] ;
          class PerHostDownload-UploadRatioAnalysis DefensiveTechniqueNode;
          class OutboundInternetMailTraffic ArtifactNode;
          click PerHostDownload-UploadRatioAnalysis href "/technique/d3f:PerHostDownload-UploadRatioAnalysis"; ProtocolMetadataAnomalyDetection["Protocol Metadata Anomaly Detection"] -->
          | analyzes | OutboundInternetMailTraffic["Outbound Internet Mail Traffic"];

          ProtocolMetadataAnomalyDetection["Protocol Metadata Anomaly Detection"] -.->
            | may-detect | T1071003["Mail Protocols"] ;
          class ProtocolMetadataAnomalyDetection DefensiveTechniqueNode;
          class OutboundInternetMailTraffic ArtifactNode;
          click ProtocolMetadataAnomalyDetection href "/technique/d3f:ProtocolMetadataAnomalyDetection"; RelayPatternAnalysis["Relay Pattern Analysis"] -->
          | analyzes | OutboundInternetMailTraffic["Outbound Internet Mail Traffic"];

          RelayPatternAnalysis["Relay Pattern Analysis"] -.->
            | may-detect | T1071003["Mail Protocols"] ;
          class RelayPatternAnalysis DefensiveTechniqueNode;
          class OutboundInternetMailTraffic ArtifactNode;
          click RelayPatternAnalysis href "/technique/d3f:RelayPatternAnalysis";                            DecoyFile["Decoy File"] -->
          | spoofs | CertificateFile["Certificate File"];

          DecoyFile["Decoy File"] -.->
            | may-deceive | T1071003["Mail Protocols"] ;
          class DecoyFile DefensiveTechniqueNode;
          class CertificateFile ArtifactNode;
          click DecoyFile href "/technique/d3f:DecoyFile"; PerHostDownload-UploadRatioAnalysis["Per Host Download-Upload Ratio Analysis"] -->
          | analyzes | OutboundInternetNetworkTraffic["Outbound Internet Network Traffic"];

          
          class PerHostDownload-UploadRatioAnalysis DefensiveTechniqueNode;
          class OutboundInternetNetworkTraffic ArtifactNode;
          click PerHostDownload-UploadRatioAnalysis href "/technique/d3f:PerHostDownload-UploadRatioAnalysis";  ProtocolMetadataAnomalyDetection["Protocol Metadata Anomaly Detection"] -->
          | analyzes | OutboundInternetNetworkTraffic["Outbound Internet Network Traffic"];

          
          class ProtocolMetadataAnomalyDetection DefensiveTechniqueNode;
          class OutboundInternetNetworkTraffic ArtifactNode;
          click ProtocolMetadataAnomalyDetection href "/technique/d3f:ProtocolMetadataAnomalyDetection";  RelayPatternAnalysis["Relay Pattern Analysis"] -->
          | analyzes | OutboundInternetNetworkTraffic["Outbound Internet Network Traffic"];

          
          class RelayPatternAnalysis DefensiveTechniqueNode;
          class OutboundInternetNetworkTraffic ArtifactNode;
          click RelayPatternAnalysis href "/technique/d3f:RelayPatternAnalysis";           Client-serverPayloadProfiling["Client-server Payload Profiling"] -->
          | analyzes | OutboundInternetMailTraffic["Outbound Internet Mail Traffic"];

          Client-serverPayloadProfiling["Client-server Payload Profiling"] -.->
            | may-detect | T1071003["Mail Protocols"] ;
          class Client-serverPayloadProfiling DefensiveTechniqueNode;
          class OutboundInternetMailTraffic ArtifactNode;
          click Client-serverPayloadProfiling href "/technique/d3f:Client-serverPayloadProfiling"; NetworkTrafficCommunityDeviation["Network Traffic Community Deviation"] -->
          | analyzes | OutboundInternetMailTraffic["Outbound Internet Mail Traffic"];

          NetworkTrafficCommunityDeviation["Network Traffic Community Deviation"] -.->
            | may-detect | T1071003["Mail Protocols"] ;
          class NetworkTrafficCommunityDeviation DefensiveTechniqueNode;
          class OutboundInternetMailTraffic ArtifactNode;
          click NetworkTrafficCommunityDeviation href "/technique/d3f:NetworkTrafficCommunityDeviation";                   CertificateAnalysis["Certificate Analysis"] -->
          | analyzes | CertificateFile["Certificate File"];

          CertificateAnalysis["Certificate Analysis"] -.->
            | may-detect | T1071003["Mail Protocols"] ;
          class CertificateAnalysis DefensiveTechniqueNode;
          class CertificateFile ArtifactNode;
          click CertificateAnalysis href "/technique/d3f:CertificateAnalysis"; Client-serverPayloadProfiling["Client-server Payload Profiling"] -->
          | analyzes | OutboundInternetNetworkTraffic["Outbound Internet Network Traffic"];

          
          class Client-serverPayloadProfiling DefensiveTechniqueNode;
          class OutboundInternetNetworkTraffic ArtifactNode;
          click Client-serverPayloadProfiling href "/technique/d3f:Client-serverPayloadProfiling";  NetworkTrafficCommunityDeviation["Network Traffic Community Deviation"] -->
          | analyzes | OutboundInternetNetworkTraffic["Outbound Internet Network Traffic"];

          
          class NetworkTrafficCommunityDeviation DefensiveTechniqueNode;
          class OutboundInternetNetworkTraffic ArtifactNode;
          click NetworkTrafficCommunityDeviation href "/technique/d3f:NetworkTrafficCommunityDeviation";        RemoteTerminalSessionDetection["Remote Terminal Session Detection"] -->
          | analyzes | OutboundInternetMailTraffic["Outbound Internet Mail Traffic"];

          RemoteTerminalSessionDetection["Remote Terminal Session Detection"] -.->
            | may-detect | T1071003["Mail Protocols"] ;
          class RemoteTerminalSessionDetection DefensiveTechniqueNode;
          class OutboundInternetMailTraffic ArtifactNode;
          click RemoteTerminalSessionDetection href "/technique/d3f:RemoteTerminalSessionDetection"; NetworkTrafficSignatureAnalysis["Network Traffic Signature Analysis"] -->
          | analyzes | OutboundInternetMailTraffic["Outbound Internet Mail Traffic"];

          NetworkTrafficSignatureAnalysis["Network Traffic Signature Analysis"] -.->
            | may-detect | T1071003["Mail Protocols"] ;
          class NetworkTrafficSignatureAnalysis DefensiveTechniqueNode;
          class OutboundInternetMailTraffic ArtifactNode;
          click NetworkTrafficSignatureAnalysis href "/technique/d3f:NetworkTrafficSignatureAnalysis";                   RemoteTerminalSessionDetection["Remote Terminal Session Detection"] -->
          | analyzes | OutboundInternetNetworkTraffic["Outbound Internet Network Traffic"];

          
          class RemoteTerminalSessionDetection DefensiveTechniqueNode;
          class OutboundInternetNetworkTraffic ArtifactNode;
          click RemoteTerminalSessionDetection href "/technique/d3f:RemoteTerminalSessionDetection";  NetworkTrafficSignatureAnalysis["Network Traffic Signature Analysis"] -->
          | analyzes | OutboundInternetNetworkTraffic["Outbound Internet Network Traffic"];

          
          class NetworkTrafficSignatureAnalysis DefensiveTechniqueNode;
          class OutboundInternetNetworkTraffic ArtifactNode;
          click NetworkTrafficSignatureAnalysis href "/technique/d3f:NetworkTrafficSignatureAnalysis";        NetworkTrafficFiltering["Network Traffic Filtering"] -->
          | filters | OutboundInternetMailTraffic["Outbound Internet Mail Traffic"];

          NetworkTrafficFiltering["Network Traffic Filtering"] -.->
            | may-isolate | T1071003["Mail Protocols"] ;
          class NetworkTrafficFiltering DefensiveTechniqueNode;
          class OutboundInternetMailTraffic ArtifactNode;
          click NetworkTrafficFiltering href "/technique/d3f:NetworkTrafficFiltering";       UserGeolocationLogonPatternAnalysis["User Geolocation Logon Pattern Analysis"] -->
          | analyzes | OutboundInternetMailTraffic["Outbound Internet Mail Traffic"];

          UserGeolocationLogonPatternAnalysis["User Geolocation Logon Pattern Analysis"] -.->
            | may-detect | T1071003["Mail Protocols"] ;
          class UserGeolocationLogonPatternAnalysis DefensiveTechniqueNode;
          class OutboundInternetMailTraffic ArtifactNode;
          click UserGeolocationLogonPatternAnalysis href "/technique/d3f:UserGeolocationLogonPatternAnalysis";       FileEviction["File Eviction"] -->
          | deletes | CertificateFile["Certificate File"];

          FileEviction["File Eviction"] -.->
            | may-evict | T1071003["Mail Protocols"] ;
          class FileEviction DefensiveTechniqueNode;
          class CertificateFile ArtifactNode;
          click FileEviction href "/technique/d3f:FileEviction"; FileEncryption["File Encryption"] -->
          | encrypts | CertificateFile["Certificate File"];

          FileEncryption["File Encryption"] -.->
            | may-harden | T1071003["Mail Protocols"] ;
          class FileEncryption DefensiveTechniqueNode;
          class CertificateFile ArtifactNode;
          click FileEncryption href "/technique/d3f:FileEncryption"; NetworkTrafficFiltering["Network Traffic Filtering"] -->
          | filters | OutboundInternetNetworkTraffic["Outbound Internet Network Traffic"];

          
          class NetworkTrafficFiltering DefensiveTechniqueNode;
          class OutboundInternetNetworkTraffic ArtifactNode;
          click NetworkTrafficFiltering href "/technique/d3f:NetworkTrafficFiltering";               FileIntegrityMonitoring["File Integrity Monitoring"] -->
          | analyzes | CertificateFile["Certificate File"];

          FileIntegrityMonitoring["File Integrity Monitoring"] -.->
            | may-detect | T1071003["Mail Protocols"] ;
          class FileIntegrityMonitoring DefensiveTechniqueNode;
          class CertificateFile ArtifactNode;
          click FileIntegrityMonitoring href "/technique/d3f:FileIntegrityMonitoring"; UserGeolocationLogonPatternAnalysis["User Geolocation Logon Pattern Analysis"] -->
          | analyzes | OutboundInternetNetworkTraffic["Outbound Internet Network Traffic"];

          
          class UserGeolocationLogonPatternAnalysis DefensiveTechniqueNode;
          class OutboundInternetNetworkTraffic ArtifactNode;
          click UserGeolocationLogonPatternAnalysis href "/technique/d3f:UserGeolocationLogonPatternAnalysis"; OutboundTrafficFiltering["Outbound Traffic Filtering"] -->
          | filters | OutboundInternetMailTraffic["Outbound Internet Mail Traffic"];

          OutboundTrafficFiltering["Outbound Traffic Filtering"] -.->
            | may-isolate | T1071003["Mail Protocols"] ;
          class OutboundTrafficFiltering DefensiveTechniqueNode;
          class OutboundInternetMailTraffic ArtifactNode;
          click OutboundTrafficFiltering href "/technique/d3f:OutboundTrafficFiltering";          OutboundTrafficFiltering["Outbound Traffic Filtering"] -->
          | filters | OutboundInternetNetworkTraffic["Outbound Internet Network Traffic"];

          
          class OutboundTrafficFiltering DefensiveTechniqueNode;
          class OutboundInternetNetworkTraffic ArtifactNode;
          click OutboundTrafficFiltering href "/technique/d3f:OutboundTrafficFiltering";     RemoteFileAccessMediation["Remote File Access Mediation"] -->
          | isolates | CertificateFile["Certificate File"];

          RemoteFileAccessMediation["Remote File Access Mediation"] -.->
            | may-isolate | T1071003["Mail Protocols"] ;
          class RemoteFileAccessMediation DefensiveTechniqueNode;
          class CertificateFile ArtifactNode;
          click RemoteFileAccessMediation href "/technique/d3f:RemoteFileAccessMediation"; LocalFilePermissions["Local File Permissions"] -->
          | restricts | CertificateFile["Certificate File"];

          LocalFilePermissions["Local File Permissions"] -.->
            | may-isolate | T1071003["Mail Protocols"] ;
          class LocalFilePermissions DefensiveTechniqueNode;
          class CertificateFile ArtifactNode;
          click LocalFilePermissions href "/technique/d3f:LocalFilePermissions"; RestoreFile["Restore File"] -->
          | restores | CertificateFile["Certificate File"];

          RestoreFile["Restore File"] -.->
            | may-restore | T1071003["Mail Protocols"] ;
          class RestoreFile DefensiveTechniqueNode;
          class CertificateFile ArtifactNode;
          click RestoreFile href "/technique/d3f:RestoreFile"; FileAnalysis["File Analysis"] -->
          | analyzes | CertificateFile["Certificate File"];

          FileAnalysis["File Analysis"] -.->
            | may-detect | T1071003["Mail Protocols"] ;
          class FileAnalysis DefensiveTechniqueNode;
          class CertificateFile ArtifactNode;
          click FileAnalysis href "/technique/d3f:FileAnalysis";
json