update to very old rule

[Jack Pepper <pepperjack () afferentsecurity com>]

The new anti spam processing in exchange 2007 now replies to all  
rejected messages with a "5.7.1" error, regardless of the reason for  
rejection.  I have changed the rule that alerts on 571s to require  
that the server specifically mention the word "Relay" in the 571  
message.

Added: content: "relay"; nocase;

So now the rule looks like this:

alert tcp $SMTP_SERVERS 25 -> $EXTERNAL_NET any (msg:"POLICY SMTP  
relaying denied"; flow:established,from_server; content:"550 5.7.1";  
depth:70; content: "relay"; nocase;  reference:arachnids,249;  
reference:url,mail-abuse.org/tsi/ar-fix.html; classtype:misc-activity;  
sid:567; rev:11;)

This has been 100% effective since I made the change.

jp


-- 

Framework?  I don't need no stinking framework!

----------------------------------------------------------------
@fferent Security Labs:  Isolate/Insulate/Innovate  
http://www.afferentsecurity.com


------------------------------------------------------------------------------
Enter the BlackBerry Developer Challenge  
This is your chance to win up to $100,000 in prizes! For a limited time, 
vendors submitting new applications to BlackBerry App World(TM) will have
the opportunity to enter the BlackBerry Developer Challenge. See full prize  
details at: http://p.sf.net/sfu/Challenge
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users