IPS Signature to protect SMTP Submission

[tonyagustin]

Hello.

We've configured a custom signature to detect Login Brute Force Attack against SMTP service:

F-SBID( --attack_id 9419; --name "SMTP.Login.Brute.Force.Custom"; --protocol tcp; --flow from_server,reversed; --pattern "Authentication failed";--no_case; --context packet; --distance 4,context; --within 40,context; --rate 5,30; --track dst_ip; )

It is include into our IPS profile. We're using SSL inspection profile (protection ssl server).

That signature works fine for SMTP (port 25) and SMTPS (port 465), but it doesn't work for SMTP submission (port 587, encrypted of course).

Anyone has configured a custom signature to protect SMTP submission?

Thank you!

[Anthony_E]

Hello Tony,

Thank you for using the Community Forum.

I will seek to get you an answer or help. We will reply to this thread with an update as soon as possible.

Regards,

[AEK · Accepted solution]

Did you try it for SMTP submission without STARTTLS? Does your signature work for it?

[tonyagustin]

Hello.

Yes, it works fine without STARTTLS.

Thank you.