Exact threat details

Reply
L1 Bithead

Exact threat details

  Hi,

 

  Is there a way to know what a specific threat ID checks for? We enabled SSL inspection for SMTP traffic and Palo started to flag every e-mail with threat ID 56951 (non-RFC compliant SMTP traffic), but ThreatDB does not provide anything useful as to what/how it is non-compliant. E-mails were received from a proper e-mail server running an older version of Postfix and using an older OpenSSL version for SSL encryption.

 

  Thanks,

 

  Morc

L0 Member

Thanks for the information 

L7 Applicator

You would need to open a case with Support.

L1 Bithead

But why? Other threat IDs have links for more information, but these non-RFC SMTP ones don't have anything.

L2 Linker

Hello Laszlo,

As you can see in ThreatVault, "This signature detects suspicious and non-RFC compliant SMTP traffic on port 25. This could be associated with applications sending non SMTP traffic using port 25 or indicate possible malicious activity.  "

This signature is alerting on port 25 traffic that is not valid SMTP traffic per RFC 5321 - Simple Mail Transfer Protocol. Security best practices recommend not allowing non SMTP traffic via port 25. Identifying the specific issue requires investigation into the actual traffic and/or hosts sending the traffic. Due to the broad category of non-rfc compliance, we are unable to provide a more specific description, as this signature simply detects if the traffic is not compliant with the RFC.

L1 Bithead

  Hi,

 

  I have seen 4 different threat IDs so far for non-RFC compliant SMTP traffic, so it's not like you have a very broad set of criteria that classifies traffic under one ID and that there could be a gazillion reasons. As I noted in my OP the sending server is a Postfix (SMTP) server, although an old one (7+ years), so I don't think it sends corrupt messages in any way and that it sent SMTP traffic, not something else. I used Thunderbird (latest as of OP's date) to send the mails via this server. Server adds a DKIM signature, which is validated OK by Google, so I don't see where the problem comes from. The problem started when we enabled SSL inspection and I believe my server was using STARTTLS with a valid certificate to encrypt traffic.

Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!