Synopsis
The remote SMTP server has just been observed initiating an FTP outbound session and retrieving a file.
Description
The remote SMTP server has just been observed initiating an FTP outbound session and retrieving a file. This may be an indicator that the system has been compromised and attackers are now retrieving files to the local server.
Solution
Disable the SMTP service if it is not required. Additionally, the observed behavior is indicative of a system compromise.
