Rule: -- Sid: 567 -- Summary: This event is generated when a failed attempt is made to use a Simple Mail Transfer Protocol (SMTP) server to relay mail to a third party. -- Impact: Rejected of unauthorized use. This event indicates that an SMTP server is properly configured to reject mail relay attempts. -- Detailed Information: An attacker may attempt to use an improperly configured SMTP server to relay mail, reflecting the origin of the mail to be the relay SMTP server instead of the actual sender. A poorly configured SMTP server may be used to relay spam and other undesirable mail. If an SMTP server rejects relay attempts, it will return an error message indicating the failure. -- Affected Systems: SMTP servers -- Attack Scenarios: An attacker may attempt to relay mail through an improperly configured SMTP server. -- Ease of Attack: Simple -- False Positives: None Known -- False Negatives: An SMTP server may reject mail using other errors. -- Corrective Action: Configure an SMTP server to reject relayed mail. -- Contributors: Original rule written by Max Vision <vision@whitehats.com> Modified by Brian Caswell <bmc@sourcefire.com> Snort documentation contributed by Chaos <c@aufbix.org> Sourcefire Research Team Judy Novak <judy.novak@sourcefire.com> -- Additional References: Arachnids http://www.whitehats.com/info/IDS249 Miscellaneous http://mail-abuse.org/tsi/ar-fix.html --
