Symantec™ Security Gateways Reference Guide - Sawmill

IDS eventsSuspicious activity447POP3 Auth AbortedBase Event:Details:IPOP3_CLIENT_AUTH_ABORTEDThe POP3 client aborted an authentication exchange. This is unusual behavior and may indicate anattempt to exploit a vulnerability or to probe for weaknesses.POP3 Malformed DataBase Event:Details:POP3_CLIENT_BAD_CMD_ARGUMENTA POP3 violation was detected in an argument to a client’s command. This violation of the standardcould indicate an attempt to compromise the protocol.POP3 Malformed DataBase Event:Details:POP3_CLIENT_BAD_INIT_COMMANDThe POP3 client sent an invalid command to the POP3 server. This violation of the standard couldindicate an attempt to compromise the protocol.POP3 Malformed DataBase Event:Details:POP3_CLIENT_CRLF_EXPECTEDA POP3 violation occurred in a client’s command. This violation of the standard could indicate anattempt to compromise the protocol.POP3 Malformed DataBase Event:Details:POP3_CLIENT_DATA_AFTER_QUITThe POP3 connection did not close after the client sent the QUIT command to the server. Thisviolation of the standard could indicate an attempt to compromise the protocol.POP3 Malformed DataBase Event:Details:POP3_CLIENT_FAILED_LOGINA failed attempt to authenticate/logon using the POP3 protocol was detected. A failedauthentication attempt may be an indication of an attack.POP3 Malformed DataBase Event:Details:POP3_CLIENT_INVALID_COMMANDThe POP3 client sent an invalid command to the server. This violation of the standard couldindicate an attempt to compromise the protocol.POP3 Malformed DataBase Event:Details:POP3_INVALID_ARG_TO_QUITThe POP3 client provided an argument to QUIT, which doesn’t take any arguments. This violationof the standard could indicate an attempt to compromise the protocol.