SignalHunt
← All rules

EMAIL-8005

high

Large Outbound Attachment Sent to a Personal Webmail Domain

Detects an outbound email with a large attachment sent to a free personal webmail domain (Gmail, Yahoo, Outlook.com, etc.) - a common, low-effort data-exfiltration path that doesn't require any malware or external tooling, just a compromised or malicious mailbox.

T1048

Detection logic

{
  "detection_type": "selection",
  "selection": {
    "direction": "outbound",
    "has_attachment": true,
    "recipient_domain": [
      "gmail.com",
      "yahoo.com",
      "outlook.com",
      "hotmail.com",
      "icloud.com"
    ],
    "attachment_size_mb|gte": 20
  }
}

Log source: category=email_gateway · Event ID(s): email_sent

Required log fields

  • direction
  • has_attachment
  • recipient_domain
  • attachment_size_mb

Enabling this in your environment

Where: Email gateway outbound DLP policy

Enable outbound DLP rules that log attachment size and recipient domain for external-bound mail (Microsoft Purview DLP outbound mail flow rules, Proofpoint/Mimecast outbound content filtering) - many gateways are tuned almost entirely for inbound threats and ship with little to no outbound visibility by default.

20MB is a starting point, not a universal threshold - tune it against your own organization's normal outbound-attachment size distribution to avoid drowning in benign "sent myself a video" alerts.

False positives

  • An employee emailing a large personal file (photos, resume) to their own personal account - common and usually benign, but worth a lightweight review process rather than silent allow
  • A contractor or partner who was never issued a corporate address and legitimately uses a personal one for business

References