Detected Potential AiTM Session Relay via Plaintext Email Protocols

Kaung Khant Ko@kaungkhantko

•updated Aug 10, 2026•2•0•11

This rule detects high-frequency, potentially malicious network connections to external infrastructure using unencrypted legacy mail protocols (SMTP: 25, POP3: 110, IMAP: 143). This pattern is consistent with an adversary-in-the-middle (AiTM) attack, where an attacker intercepts email traffic—often following DNS hijacking—to relay and potentially decrypt or harvest credentials and session tokens from plaintext sessions.