icons icons icons icons icons icons icons icons icons icons icons icons icons icons icons icons icons icons icons icons icons icons icons icons icons icons icons icons icons icons icons icons icons icons icons icons icons icons icons icons icons icons icons icons icons icons icons icons icons icons icons icons icons icons icons icons_061

FTP Client Initiated from an SMTP Server

High

Synopsis

The remote SMTP server has just been observed initiating an FTP outbound session and retrieving a file.

Description

The remote SMTP server has just been observed initiating an FTP outbound session and retrieving a file. This may be an indicator that the system has been compromised and attackers are now retrieving files to the local server.

Solution

Disable the SMTP service if it is not required. Additionally, the observed behavior is indicative of a system compromise.