Techniques › T1667
T1667 Email Bombing
impact — Linux, Office Suite, Windows, macOS · attack.mitre.org · JSON
1
MITRE detection strategy
4
analytics
0
Sigma rules tagged attack.t1667
0
KEV CVEs mapped here
<p>Adversaries may flood targeted email addresses with an overwhelming volume of messages. This may bury legitimate emails in a flood of spam and disrupt business operations.</p><p>An adversary may accomplish email bombing by leveraging an automated bot to register a targeted address for e-mail lists that do not validate new signups, such as online newsletters. The result can be a wave of thousands of e-mails that effectively overloads the victim’s inbox.</p><p>By sending hundreds or thousands of e-mails in quick succession, adversaries may successfully divert attention away from and bury legitimate messages including security alerts, daily business processes like help desk tickets and client correspondence, or ongoing scams. This behavior can also be used as a tool of harassment.</p><p>This behavior may be a precursor for Spearphishing Voice. For example, an adversary may email bomb a target and then follow up with a phone call to fraudulently offer assistance. This social engineering may lead to the use of Remote Access Software to steal credentials, deploy ransomware, conduct Financial Theft, or engage in other malicious activity.</p>
KEV CVEs mapped to this technique · CTID Mappings Explorer
None. No KEV entry in the public mapping names this technique. Given that 74.7% of KEV has no mapping at all, this says more about the mapping than about the technique.
Detection strategy · ATT&CK Enterprise v19.2
- DET0355 Detection Strategy for Email Bombing v1.0
AN1008 WindowsDetect abnormally high volume of inbound email messages or repetitive attachments being delivered to a single mailbox within a short time window. Defenders should look for anomalous spikes in message counts and repetitive attachment file creation events correlated with targeted users.m365:unified
Send/Receive: Unusual spikes in inbound messages to a single recipient→ DC0038 Application Log ContentTunable:TimeWindowRecipientThresholdAttachmentSizeThresholdAN1009 LinuxMonitor mail server logs (e.g., Postfix, Sendmail) for excessive connections or inbound message counts targeting a single recipient. Correlate with repetitive attachment storage in /var/mail or /var/spool/mail directories.auditd:SYSCALLFile creation events in /var/mail or /var/spool/mail exceeding baseline thresholds→ DC0039 File CreationApplication:MailHigh-frequency inbound mail activity to a specific recipient address→ DC0038 Application Log ContentTunable:MailVolumeThresholdAttachmentPatternListAN1010 Office SuiteDetect abnormal use of email clients (e.g., Outlook, Thunderbird) showing mass arrival of messages or repetitive attachments being locally stored. Correlate message volume with file creation activity in mail cache directories.m365:exchangeMailDelivery: High-frequency delivery of messages or attachments to a single recipient→ DC0038 Application Log ContentTunable:UserContextAN1011 macOSMonitor unified logs and Mail.app activity for repetitive incoming messages with attachments. Defenders should look for large volumes of incoming mail stored under ~/Library/Mail with unusual timing or repetitive subjects.macos:unifiedlogRepetitive inbound email delivery activity logged within a short time window→ DC0038 Application Log ContentTunable:FileCountThreshold
Sigma rules · SigmaHQ da9bb07d64, tag attack.t1667
No Sigma rule carries this tag. MITRE publishes a detection strategy above, so the behaviour is specified; what is missing is public detection content.