NF – Outbound mail setup command EHLO
This alert is triggered when an outbound SMTP connection is made from the internal network, and the email client sends the "EHLO" command to initiate communication. This command is typically used in setting up an email connection but may be flagged in networks where outbound email should be restricted.
ID Number
5004013
Signature
alert tcp $HOME_NET any -> $EXTERNAL_NET [25,26,587] (msg:"NF - Outbound mail setup command EHLO"; flow:from_client,established; content:"ehlo"; within:4; nocase; reference:url,networkforensic.dk; metadata:31102019; classtype:misc-activity; sid:5004013; rev:1;)
Severity
High
Recommendations/Investigative actions
Identify the device or application initiating the outbound email to confirm it is authorized.
Restrict or block the device’s access to send emails externally if it’s not part of the expected activity.
Check for repeated or unexpected outbound email attempts, which may indicate malware or data exfiltration.