2_ds_unix_unix_sendmail.md

Use-Case	Event Types/Parsers	MITRE TTP	Content
Data Leak	authentication-failed ↳q-sendmail-dlp-email-alert ↳s-sendmail-email-from dlp-email-alert-in ↳sendmail-email-from ↳s-sendmail-email-from dlp-email-alert-in-failed ↳sendmail-email-from ↳s-sendmail-email-from dlp-email-alert-out ↳q-sendmail-dlp-email-alert ↳sendmail-email-from ↳sendmail-email-from ↳s-sendmail-email-from	T1020 - Automated Exfiltration T1048 - Exfiltration Over Alternative Protocol T1048.003 - Exfiltration Over Alternative Protocol: Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol	31 Rules 15 Models
Evasion	authentication-failed ↳q-sendmail-dlp-email-alert ↳s-sendmail-email-from dlp-email-alert-in ↳sendmail-email-from ↳s-sendmail-email-from dlp-email-alert-in-failed ↳sendmail-email-from ↳s-sendmail-email-from dlp-email-alert-out ↳q-sendmail-dlp-email-alert ↳sendmail-email-from ↳sendmail-email-from ↳s-sendmail-email-from	T1090.003 - Proxy: Multi-hop Proxy	1 Rules
Phishing	authentication-failed ↳q-sendmail-dlp-email-alert ↳s-sendmail-email-from dlp-email-alert-in ↳sendmail-email-from ↳s-sendmail-email-from dlp-email-alert-in-failed ↳sendmail-email-from ↳s-sendmail-email-from dlp-email-alert-out ↳q-sendmail-dlp-email-alert ↳sendmail-email-from ↳sendmail-email-from ↳s-sendmail-email-from	T1048.003 - Exfiltration Over Alternative Protocol: Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol	12 Rules 6 Models
Privilege Abuse	authentication-failed ↳q-sendmail-dlp-email-alert ↳s-sendmail-email-from dlp-email-alert-in ↳sendmail-email-from ↳s-sendmail-email-from dlp-email-alert-in-failed ↳sendmail-email-from ↳s-sendmail-email-from dlp-email-alert-out ↳q-sendmail-dlp-email-alert ↳sendmail-email-from ↳sendmail-email-from ↳s-sendmail-email-from	T1078 - Valid Accounts	1 Rules
Privileged Activity	authentication-failed ↳q-sendmail-dlp-email-alert ↳s-sendmail-email-from dlp-email-alert-in ↳sendmail-email-from ↳s-sendmail-email-from dlp-email-alert-in-failed ↳sendmail-email-from ↳s-sendmail-email-from dlp-email-alert-out ↳q-sendmail-dlp-email-alert ↳sendmail-email-from ↳sendmail-email-from ↳s-sendmail-email-from	T1078 - Valid Accounts	1 Rules
Ransomware	authentication-failed ↳q-sendmail-dlp-email-alert ↳s-sendmail-email-from dlp-email-alert-in ↳sendmail-email-from ↳s-sendmail-email-from dlp-email-alert-in-failed ↳sendmail-email-from ↳s-sendmail-email-from dlp-email-alert-out ↳q-sendmail-dlp-email-alert ↳sendmail-email-from ↳sendmail-email-from ↳s-sendmail-email-from	T1078 - Valid Accounts	1 Rules
Workforce Protection	authentication-failed ↳q-sendmail-dlp-email-alert ↳s-sendmail-email-from dlp-email-alert-in ↳sendmail-email-from ↳s-sendmail-email-from dlp-email-alert-in-failed ↳sendmail-email-from ↳s-sendmail-email-from dlp-email-alert-out ↳q-sendmail-dlp-email-alert ↳sendmail-email-from ↳sendmail-email-from ↳s-sendmail-email-from	T1048.003 - Exfiltration Over Alternative Protocol: Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol	4 Rules 2 Models