kevmap

TechniquesT1505.002 › AN0473

AN0473 Analytic 0473

Linux · attack.mitre.org · ATT&CK Enterprise v19.2

<p>Adversary installs or modifies email content filters or transport scripts (e.g., Postfix milter, Sendmail milter, Exim filters) using shell access or configuration manipulation.</p>
Detects
T1505.002 Transport Agent
Part of
DET0166 Detection Strategy for T1505.002 - Transport Agent Abuse (Windows/Linux)

Log sources and channels

Exactly as MITRE states them in x_mitre_log_source_references. Where a channel is vague, it is vague in the source; kevmap does not tidy it.

Log sourceChannelData component
auditd:SYSCALLwriteDC0061 File Modification
linux:syslogmilter configuration updated, transport rule initialized, unexpected script executionDC0038 Application Log Content
auditd:EXECVE/usr/sbin/postfix, /usr/sbin/exim, /usr/sbin/sendmailDC0032 Process Creation
auditd:SYSCALLwriteDC0039 File Creation
linux:SysmonEventCode=7DC0016 Module Load

Mutable elements

Parameters MITRE marks as environment-specific. These are the knobs you are expected to tune; they are why an analytic is not a rule.

FieldDescription
MailTransportScriptPathPath to custom scripts or filters depends on mail daemon (e.g., /etc/postfix/milter/, /etc/exim4/).
UserContextMail agents may run under different service users (postfix, exim, etc.), which should be scoped.
ExecFrequencyThresholdFrequency of filter script re-execution per daemon restart or reload may vary.