SID 1:45116

Rule Category

SERVER-MAIL -- Snort has detected traffic exploiting vulnerabilities in mail servers (such as Exchange, Courrier). These are different from protocol traffic, as this deals with the traffic going to the mail server itself.

Alert Message

SERVER-MAIL Multiple products non-ascii sender address spoofing attempt

Rule Explanation

This event is generated when an attacker attempts to spoof their FROM mail address. Impact: Email phishing Details: Rule checks for an attempt to spoof their FROM email address using non-ASCII encoded values. Ease of Attack: Simple

What To Look For

No information provided

Known Usage

No public information

False Positives

No known false positives

Contributors

Cisco Talos Intelligence Group