prelude-lml 1.0.0-5.3+b4 / etc / prelude-lml / ruleset / sendmail.rules

#####
#
# Copyright (C) 2004 G Ramon Gomez <gene at gomezbrothers dot com>
# All Rights Reserved
#
# This file is part of the Prelude-LML program.
#
# This program is free software; you can redistribute it and/or modify
# it under the terms of the GNU General Public License as published by 
# the Free Software Foundation; either version 2, or (at your option)
# any later version.
#
# This program is distributed in the hope that it will be useful,
# but WITHOUT ANY WARRANTY; without even the implied warranty of
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
# GNU General Public License for more details.
#
# You should have received a copy of the GNU General Public License
# along with this program; see the file COPYING.  If not, write to
# the Free Software Foundation, 675 Mass Ave, Cambridge, MA 02139, USA.
#
#####

#####
#
# The rules included here were developed using Sendmail 8.12.8-9.90.  Please
# report any inconsistencies on other versions to G Ramon Gomez at the
# address provided above
#
#####

#LOG:Jun 20 04:21:33 mail sendmail[28792]: ruleset=check_relay, arg1=c-67-181-100-174.client.comcast.net, arg2=67.181.100.174, relay=c-67-181-100-174.client.comcast.net [67.181.100.174], reject=550 5.7.1 Mail from 67.181.100.174 refused - see http://dsbl.org/
#LOG:Jun 22 09:01:52 mail sendmail[5475]: ruleset=check_relay, arg1=[61.102.237.129], arg2=61.102.237.129, relay=[61.102.237.129], reject=550 5.7.1 Mail from 61.102.237.129 refused - see http://dsbl.org/
regex=ruleset=check_relay, arg1=([\[\]\w\-\.]+), arg2=([\d\.]+), relay=.*\[[\d\.]+\], reject=550 5\.7\.1 (.+); \
 classification.text=Mail server relay access denied; \
 classification.reference(0).origin=vendor-specific; \
 classification.reference(0).meaning=rfc821_id; \
 classification.reference(0).name=550; \
 classification.reference(0).url=http://rfc.net/rfc821.html; \
 classification.reference(1).origin=vendor-specific; \
 classification.reference(1).meaning=rfc2476_id; \
 classification.reference(1).name=5.7.1; \
 classification.reference(1).url=http://rfc.net/rfc2476.html; \
 id=3700; \
 revision=2; \
 analyzer(0).name=Sendmail; \
 analyzer(0).manufacturer=www.sendmail.org; \
 analyzer(0).class=Service; \
 assessment.impact.completion=failed; \
 assessment.impact.type=other; \
 assessment.impact.severity=medium; \
 assessment.impact.description=$1 attempted to use mail server as relay, and was denied.; \
 source(0).node.name=$1; \
 source(0).node.address(0).category=ipv4-addr; \
 source(0).node.address(0).address=$2; \
 source(0).service.iana_protocol_name=tcp; \
 source(0).service.iana_protocol_number=6; \
 target(0).service.iana_protocol_name=tcp; \
 target(0).service.iana_protocol_number=6; \
 target(0).service.port=25; \
 target(0).service.name=smtp; \
 additional_data(0).type=string; \
 additional_data(0).meaning=ACL; \
 additional_data(0).data=check_relay; \
 additional_data(1).type=string; \
 additional_data(1).meaning=Failure reason; \
 additional_data(1).data=$3; \
 last;

#LOG:Jun 19 23:20:27 mail sendmail[28096]: i5K6KJmk028096: ruleset=check_rcpt, arg1=<support@microsoft.com>, relay=[211.243.40.167], reject=550 5.7.1 <support@microsoft.com>... Relaying denied. IP name lookup failed [211.243.40.167]
regex=(\S+): ruleset=check_rcpt, arg1=<(\S+@\S+)>, relay=.*\[([\d\.]+)\], reject=550 5\.7\.1 (.+); \
 classification.text=Mail server relay access denied; \
 classification.reference(0).origin=vendor-specific; \
 classification.reference(0).meaning=rfc821_id; \
 classification.reference(0).name=550; \
 classification.reference(0).url=http://rfc.net/rfc821.html; \
 classification.reference(1).origin=vendor-specific; \
 classification.reference(1).meaning=rfc2476_id; \
 classification.reference(1).name=5.7.1; \
 classification.reference(1).url=http://rfc.net/rfc2476.html; \
 id=3701; \
 revision=2; \
 analyzer(0).name=Sendmail; \
 analyzer(0).manufacturer=www.sendmail.org; \
 analyzer(0).class=Service; \
 assessment.impact.completion=failed; \
 assessment.impact.type=other; \
 assessment.impact.severity=medium; \
 assessment.impact.description=$2 attempted to use mail server as relay, and was denied.; \
 source(0).node.address(0).category=e-mail; \
 source(0).node.address(0).address=$2; \
 source(0).node.address(1).category=ipv4-addr; \
 source(0).node.address(1).address=$3; \
 source(0).service.iana_protocol_name=tcp; \
 source(0).service.iana_protocol_number=6; \
 target(0).service.iana_protocol_name=tcp; \
 target(0).service.iana_protocol_number=6; \
 target(0).service.port=25; \
 target(0).service.name=smtp; \
 additional_data(0).type=string; \
 additional_data(0).meaning=Session ID; \
 additional_data(0).data=$1; \
 additional_data(1).type=string; \
 additional_data(1).meaning=ACL; \
 additional_data(1).data=check_rcpt; \
 additional_data(2).type=string; \
 additional_data(2).meaning=Failure reason; \
 additional_data(2).data=$4; \
 last;

#LOG:Jun 25 17:30:55 mail sendmail[29822]: i5Q0Ukjt029822: ruleset=check_mail, arg1=<vrrfvbvwzihdz@cninfo.net>, relay=[211.210.172.167], reject=553 5.1.8 <vrrfvbvwzihdz@cninfo.net>... Domain of sender address vrrfvbvwzihdz@cninfo.net does not exist
regex=(\S+): ruleset=check_mail, arg1=<(\S+@\S+)>, relay=.*\[([\d\.]+)\], reject=553 5\.1\.8 (.+); \
 classification.text=Mail server relay access denied; \
 classification.reference(0).origin=vendor-specific; \
 classification.reference(0).meaning=rfc821_id; \
 classification.reference(0).name=553; \
 classification.reference(0).url=http://rfc.net/rfc821.html; \
 classification.reference(1).origin=vendor-specific; \
 classification.reference(1).meaning=rfc2476_id; \
 classification.reference(1).name=5.1.8; \
 classification.reference(1).url=http://rfc.net/rfc2476.html; \
 id=3702; \
 revision=2; \
 analyzer(0).name=Sendmail; \
 analyzer(0).manufacturer=www.sendmail.org; \
 analyzer(0).class=Service; \
 assessment.impact.completion=failed; \
 assessment.impact.type=other; \
 assessment.impact.severity=medium; \
 assessment.impact.description=$2 attempted to use mail server as relay, and was denied.; \
 source(0).node.address(0).category=e-mail; \
 source(0).node.address(0).address=$2; \
 source(0).node.address(1).category=ipv4-addr; \
 source(0).node.address(1).address=$3; \
 source(0).service.iana_protocol_name=tcp; \
 source(0).service.iana_protocol_number=6; \
 target(0).service.iana_protocol_name=tcp; \
 target(0).service.iana_protocol_number=6; \
 target(0).service.port=25; \
 target(0).service.name=smtp; \
 additional_data(0).type=string; \
 additional_data(0).meaning=Session ID; \
 additional_data(0).data=$1; \
 additional_data(1).type=string; \
 additional_data(1).meaning=ACL; \
 additional_data(1).data=check_mail; \
 additional_data(2).type=string; \
 additional_data(2).meaning=Failure reason; \
 additional_data(2).data=$4; \
 last;

#LOG:Jun 22 09:23:54 mail sendmail: sendmail shutdown succeeded
regex=sendmail shutdown succeeded; \
 classification.text=Mail server shutdown; \
 id=3703; \
 revision=1; \
 analyzer(0).name=Sendmail; \
 analyzer(0).manufacturer=www.sendmail.org; \
 analyzer(0).class=Service; \
 assessment.impact.completion=succeeded; \
 assessment.impact.description=Sendmail reported a shutdown; \
 assessment.impact.type=other; \
 assessment.impact.severity=medium; \
 last;

#LOG:Jun 22 09:23:54 mail sendmail: sendmail startup succeeded
regex=sendmail startup succeeded; \
 classification.text=Mail server startup; \
 id=3704; \
 revision=1; \
 analyzer(0).name=Sendmail; \
 analyzer(0).manufacturer=www.sendmail.org; \
 analyzer(0).class=Service; \
 assessment.impact.completion=succeeded; \
 assessment.impact.description=Sendmail reported a startup; \
 assessment.impact.type=other; \
 assessment.impact.severity=info; \
 last;

#LOG:Jun 22 06:43:01 mail sendmail[5195]: i5MDgomk005195: AClermont-Ferrand-108-1-6-103.w81-49.abo.wanadoo.fr [81.49.192.103] did not issue MAIL/EXPN/VRFY/ETRN during connection to MTA
regex=(\S+): ([\w\-\.]+) \[([\d\.]+)\] did not issue MAIL/EXPN/VRFY/ETRN during connection to MTA; \
 classification.text=Mail server suspicious access; \
 id=3705; \
 revision=2; \
 analyzer(0).name=Sendmail; \
 analyzer(0).manufacturer=www.sendmail.org; \
 analyzer(0).class=Service; \
 assessment.impact.completion=failed; \
 assessment.impact.description=Lost connection from $2.  Might be a version scanner or a spammer.; \
 assessment.impact.type=recon; \
 assessment.impact.severity=low; \
 source(0).node.name=$2; \
 source(0).node.address(0).category=ipv4-addr; \
 source(0).node.address(0).address=$3; \
 source(0).service.iana_protocol_name=tcp; \
 source(0).service.iana_protocol_number=6; \
 target(0).service.iana_protocol_name=tcp; \
 target(0).service.iana_protocol_number=6; \
 target(0).service.port=25; \
 target(0).service.name=smtp; \
 additional_data(0).type=string; \
 additional_data(0).meaning=Session ID; \
 additional_data(0).data=$1; \
 last;

#LOG:Jun 25 18:59:39 mail sendmail[29873]: i5Q1xRjt029873: <boagcxwl@gomezbrothers.com>... User unknown
regex=(\S+): <(\S+@\S+)>... User unknown; \
 classification.text=Mail server unknown user; \
 id=3706; \
 revision=2; \
 analyzer(0).name=Sendmail; \
 analyzer(0).manufacturer=www.sendmail.org; \
 analyzer(0).class=Service; \
 assessment.impact.completion=failed; \
 assessment.impact.description=Mail was sent to unknown user $2.  This could be a scan for valid email addresses, or email to an old, now invalid account.; \
 assessment.impact.type=recon; \
 assessment.impact.severity=low; \
 source(0).service.iana_protocol_name=tcp; \
 source(0).service.iana_protocol_number=6; \
 target(0).node.address(0).category=e-mail; \
 target(0).node.address(0).address=$2; \
 target(0).service.iana_protocol_name=tcp; \
 target(0).service.iana_protocol_number=6; \
 target(0).service.port=25; \
 target(0).service.name=smtp; \
 additional_data(0).type=string; \
 additional_data(0).meaning=Session ID; \
 additional_data(0).data=$1; \
 last;

#LOG:Jun  4 12:25:26 mail sendmail[21691]: i54JPQCi021691: Authentication-Warning: mail.somehost.com: apache set sender to someguy@somehost.com using -f
regex=(\S+): Authentication-Warning: ([\w\-\.]+): (\S+) set sender to (\S+@\S+) using; \
 classification.text=Mail server user obfuscation; \
 id=3707; \
 revision=2; \
 analyzer(0).name=Sendmail; \
 analyzer(0).manufacturer=www.sendmail.org; \
 analyzer(0).class=Service; \
 assessment.impact.completion=succeeded; \
 assessment.impact.description=$3 sent email as $4 instead of the assigned e-mail address.  This may be normal (webmail systems do this), or it could be an attempt to hide the email originator.; \
 assessment.impact.type=other; \
 assessment.impact.severity=low; \
 source(0).user.user_id(0).type=current-user; \
 source(0).user.user_id(0).name=$3; \
 source(0).service.iana_protocol_name=tcp; \
 source(0).service.iana_protocol_number=6; \
 target(0).node.name=$2; \
 target(0).node.address(0).category=e-mail; \
 target(0).node.address(0).address=$4; \
 target(0).service.iana_protocol_name=tcp; \
 target(0).service.iana_protocol_number=6; \
 target(0).service.port=25; \
 target(0).service.name=smtp; \
 additional_data(0).type=string; \
 additional_data(0).meaning=Session ID; \
 additional_data(0).data=$1; \
 last;

#LOG:Jul  3 06:10:43 mail sendmail[17436]: i63DAajt017436: PPPa1736.tokyo-ip.dti.ne.jp [210.170.207.236]: VRFY somebody [rejected]
regex=(\S+): ([\w\-\.]+) \[([\d\.]+)\]: VRFY (\S+) \[rejected\]; \
 classification.text=Mail server user discovery; \
 id=3708; \
 revision=2; \
 analyzer(0).name=Sendmail; \
 analyzer(0).manufacturer=www.sendmail.org; \
 analyzer(0).class=Service; \
 assessment.impact.completion=failed; \
 assessment.impact.description=$2 tried to establish whether $4 existed or not.  This could be a scan for valid email addresses.; \
 assessment.impact.type=recon; \
 assessment.impact.severity=medium; \
 source(0).node.name=$2; \
 source(0).node.address(0).category=ipv4-addr; \
 source(0).node.address(0).address=$3; \
 source(0).service.iana_protocol_name=tcp; \
 source(0).service.iana_protocol_number=6; \
 target(0).node.address(0).category=e-mail; \
 target(0).node.address(0).address=$3; \
 target(0).service.iana_protocol_name=tcp; \
 target(0).service.iana_protocol_number=6; \
 target(0).service.port=25; \
 target(0).service.name=smtp; \
 additional_data(0).type=string; \
 additional_data(0).meaning=Session ID; \
 additional_data(0).data=$1; \
 last;

#LOG:Jul  3 06:10:43 mail sendmail[17436]: i63DAajt017436: PPPa1736.tokyo-ip.dti.ne.jp [210.170.207.236]: EXPN somegroup [rejected]
regex=(\S+): ([\w\-\.]+) \[([\d\.]+)\]: EXPN (\S+) \[rejected\]; \
 classification.text=Mail server group member discovery; \
 id=3709; \
 revision=2; \
 analyzer(0).name=Sendmail; \
 analyzer(0).manufacturer=www.sendmail.org; \
 analyzer(0).class=Service; \
 assessment.impact.completion=failed; \
 assessment.impact.description=$2 tried to establish group memberships for $4.  This could be a scan for valid email addresses.; \
 assessment.impact.type=recon; \
 assessment.impact.severity=medium; \
 source(0).node.name=$2; \
 source(0).node.address(0).category=ipv4-addr; \
 source(0).node.address(0).address=$3; \
 source(0).service.iana_protocol_name=tcp; \
 source(0).service.iana_protocol_number=6; \
 target(0).node.address(0).category=e-mail; \
 target(0).node.address(0).address=$4; \
 target(0).service.iana_protocol_name=tcp; \
 target(0).service.iana_protocol_number=6; \
 target(0).service.port=25; \
 target(0).service.name=smtp; \
 additional_data(0).type=string; \
 additional_data(0).meaning=Session ID; \
 additional_data(0).data=$1; \
 last;


#LOG:Apr  5 16:59:43 vm-mail sendmail[1821]: k35NxhZA001821: from=ccook@xxx.com, size=357, class=0, nrcpts=1, msgid=<443459EF.mail1EK1XC3LT@xxx.com>, relay=root@localhost
regex=from=(\S+), size=(\d+), class=\d+, nrcpts=\d+, msgid=<(\S+@\S+)>; \
 new_context=SPAMASSASSIN_$3,expire:10; \
 source(0).node.address(0).category=e-mail; \
 source(0).node.address(0).address=$1; \
 additional_data(0).type=integer; \
 additional_data(0).meaning=Size; \
 additional_data(0).data=$2; \
 silent;