SMTP_B64_DECODING_FAILED
This alert is triggered when an SMTP (email) message fails Base64 decoding, which may indicate a malformed or potentially suspicious email, possibly attempting to bypass security filters.
ID Number
10
Signature
alert ( msg: "SMTP_B64_DECODING_FAILED"; sid: 10; gid: 124; rev: 1; metadata: rule-type preproc, service smtp ; classtype:unknown; )
Severity
Medium
Recommendations/Investigative actions
Check the sender and source IP to determine if the email is from a trusted or known source.
Block or quarantine the email.
Analyze the email for signs of phishing, malware, or other harmful content that may be hidden in a malformed encoding.