We've configured a custom signature to detect Login Brute Force Attack against SMTP service:
F-SBID( --attack_id 9419; --name "SMTP.Login.Brute.Force.Custom"; --protocol tcp; --flow from_server,reversed; --pattern "Authentication failed";--no_case; --context packet; --distance 4,context; --within 40,context; --rate 5,30; --track dst_ip; )
It is include into our IPS profile. We're using SSL inspection profile (protection ssl server).
That signature works fine for SMTP (port 25) and SMTPS (port 465), but it doesn't work for SMTP submission (port 587, encrypted of course).
Anyone has configured a custom signature to protect SMTP submission?
Go to Solution.
Did you try it for SMTP submission without STARTTLS? Does your signature work for it?
View solution in original post
Thank you for using the Community Forum.
I will seek to get you an answer or help. We will reply to this thread with an update as soon as possible.
Yes, it works fine without STARTTLS.