Exact threat details

[KozbeszHat]

  Hi,

  Is there a way to know what a specific threat ID checks for? We enabled SSL inspection for SMTP traffic and Palo started to flag every e-mail with threat ID 56951 (non-RFC compliant SMTP traffic), but ThreatDB does not provide anything useful as to what/how it is non-compliant. E-mails were received from a proper e-mail server running an older version of Postfix and using an older OpenSSL version for SSL encryption.

  Thanks,

  Morc

[Millender12]

Thanks for the information 

[mivaldi]

You would need to open a case with Support.

[KozbeszHat]

But why? Other threat IDs have links for more information, but these non-RFC SMTP ones don't have anything.

[brcook]

Hello Laszlo,

As you can see in ThreatVault, "This signature detects suspicious and non-RFC compliant SMTP traffic on port 25. This could be associated with applications sending non SMTP traffic using port 25 or indicate possible malicious activity.  "

This signature is alerting on port 25 traffic that is not valid SMTP traffic per RFC 5321 - Simple Mail Transfer Protocol. Security best practices recommend not allowing non SMTP traffic via port 25. Identifying the specific issue requires investigation into the actual traffic and/or hosts sending the traffic. Due to the broad category of non-rfc compliance, we are unable to provide a more specific description, as this signature simply detects if the traffic is not compliant with the RFC.

[KozbeszHat]

  Hi,

  I have seen 4 different threat IDs so far for non-RFC compliant SMTP traffic, so it's not like you have a very broad set of criteria that classifies traffic under one ID and that there could be a gazillion reasons. As I noted in my OP the sending server is a Postfix (SMTP) server, although an old one (7+ years), so I don't think it sends corrupt messages in any way and that it sent SMTP traffic, not something else. I used Thunderbird (latest as of OP's date) to send the mails via this server. Server adds a DKIM signature, which is validated OK by Google, so I don't see where the problem comes from. The problem started when we enabled SSL inspection and I believe my server was using STARTTLS with a valid certificate to encrypt traffic.