Postfix Non-SMTP Command Detection Scenario by crowdsecurity | CrowdSec Hub

Postfix Non-SMTP Command

Attack scenariogeneric:scan

By: crowdsecurity
Version: 0.2
Name: crowdsecurity/postfix-non-smtp-command
Remediation: Ban

Detect scanning of postfix service through non-SMTP commands

Install with a top-level collection

2 collections include it

sudo cscli collections install crowdsecurity/apiscp

Installs 9 parsers and 56 scenarios, via Postfix - Bruteforce Protection.

View ApisCP →

Installation

sudo cscli scenarios install crowdsecurity/postfix-non-smtp-command

Then reload CrowdSec: sudo systemctl reload crowdsec

Configuration

Hover a line or a note to see what each field does.

scenarios/crowdsecurity/postfix-non-smtp-command.yaml· 15 linesGitHub

1type: trigger1
2name: crowdsecurity/postfix-non-smtp-command
3description: "Detect scanning of postfix service through non-SMTP commands"
4filter: "evt.Meta.service == 'postfix' && evt.Meta.log_type_enh == 'non-smtp-command'"2
5groupby: evt.Meta.source_ip3
6blackhole: 1m4
7reprocess: false
8labels:
9  service: postfix
10  remediation: true5
11  confidence: 3
12  spoofable: 0
13  behavior: "generic:scan"
14  intent: malicious
15  label: "Postfix Non-SMTP Command"

Installed on

Know where it runs

Sign in to see the Security Engines that run this attack scenario, the version they run and whether it was modified locally.

Documentation

Postfix non-SMTP commands

Postfix non-SMTP commands is a log message generated when a client sends a command that is not recognized by the server. This primarily happens when a IP address is enumerating services on a machine.