Symantec™ Security Gateways Reference Guide - Sawmill

448 IDS eventsSuspicious activityPOP3 Malformed DataBase Event:Details:POP3_SERVER_BAD_BASE64_STRThe POP3 server sent an invalid base64 string during an authentication exchange with the client.This violation of the standard could indicate an attempt to compromise the protocol.POP3 Malformed DataBase Event:Details:POP3_SERVER_BAD_GREETINGThe POP3 server sent an invalid greeting upon accepting a client’s connection. This violation of thestandard could indicate an attempt to compromise the protocol.POP3 Malformed DataBase Event:Details:POP3_SERVER_INVALID_CHAR_IN_RESPONSEThe POP3 server’s response violated POP3 protocol. This violation of the standard could indicatean attempt to compromise the protocol.POP3 Malformed DataBase Event:Details:POP3_SERVER_INVALID_RESPONSEThe POP3 server’s response violated POP3 protocol. This violation of the standard could indicatean attempt to compromise the protocol.Rlogin Auth FailureBase Event:Details:Response:Affected:RLOGIN_LOGIN_FAILEDAn rlogin failed logon attempt was detected. This may be an attempt to break into the server.If seen in sufficient volume or variation, audit of client and server is recommended. Examination ofthe packet contents may provide some additional information about the particular command.No specific targets.False Positives: It is possible that this is a user that mistyped his or her password.ReferencesRlogin SpecificationsRlogin Auth FailureBase Event:Details:Response:Affected:RLOGIN_ROOT_LOGIN_FAILEDA failed root rlogin attempt was detected. This may be an attempt to break into the server.Audit of client and server is recommended. Examination of the packet contents may provide someadditional information about the particular command.No specific targets.False Positives: It is possible that the administrator mistyped his or her password.ReferencesRlogin Specifications