Facebook Google Plus Twitter LinkedIn YouTube RSS Menu Search Resource - BlogResource - WebinarResource - ReportResource - Eventicons_066 icons_067icons_068icons_069icons_070

FTP Client Initiated from an SMTP Server

High

Synopsis

The remote SMTP server has just been observed initiating an FTP outbound session and retrieving a file.

Description

The remote SMTP server has just been observed initiating an FTP outbound session and retrieving a file. This may be an indicator that the system has been compromised and attackers are now retrieving files to the local server.

Solution

Disable the SMTP service if it is not required. Additionally, the observed behavior is indicative of a system compromise.