DETECTION OVERVIEW
Risk Factors
Simple Mail Transfer Protocol (SMTP) errors can be associated with a range of issues. A large number of 400-level errors could indicate misconfigured email applications or spam botnet activity. Spam emails are often part of a phishing campaign to collect sensitive information, such as usernames and passwords. A large number of 500-level errors could indicate problems with an email server, or a potential brute force attack, which can help an attacker obtain valid email server credentials.
The system might change the risk score for this detection.
Kill Chain
Risk Score
—
N/A
Quarantine the client device while checking for indicators of compromise, such as the presence of malware
Add multi-factor authentication to SMTP servers
Block the source email address that is sending spam emails