Signature Detail

SMTP: Microsoft Exchange Guest Account Auth

This signature detects attempts to use SMTP AUTH to authenticate to a Microsoft Exchange mail server using the guest account. Although guest accounts are disabled by default, they can be accidentally activated in multiple ways. Spammers can use this guest account to relay spam through a server that would normally not permit relaying.

Extended Description

When the guest accounts are enabled, an attacker can utilize Exchange Server as a relay with which to send spam e-mail messages.

References

• URL: http://www.winnetmag.com/Article/ArticleID/40543/40543.html