1

I have a machine sending out spam on my network. Message tracking in Exchange shows the source IP as the IP of my Exchange Cluster rather than the source workstation. The user's PC was off during the time when the messages were sent so it appears to have come from a different workstation, OWA or mobile device. I've checked OWA logs and the only thing to connect with his credentials has been his IPhone.

I now want to find the logs that will show me which devices (IP address) have connected to Exchange via Outlook (MAPI) but I can't seem to find this log file. I have googled and also searched through this forum before posting and have only found others with my same question - no answer.

Thanks

3
  • Did you end up locating the source of the messages? Jan 24, 2012 at 20:13
  • Yes but unfortunately I cannot disclose anything more about this at this time. Thank you though for preventing me from spinning my wheels looking for MAPI logs. Jan 24, 2012 at 20:33
  • Good to hear you found the source, even if you're not able to provide details. Jan 24, 2012 at 21:29

2 Answers 2

2

There is no feature in Exchange 2007 to do what you're looking for, specifically. Mailbox Audit Logging was added in Exchange 2010 to "beef up" the auditing capabilities on mailbox access through MAPI.

It would be unique, in my experience, to have a client submitting spam via MAPI. It's much more likely that you've allowed open relaying from either your LAN or the Internet and the messages are being relayed via SMTP. It's also possible that they're originating on the Exchange Server computer itself.

I'd setup a port-mirror of the Exchange Server computer's network interface and sniff all SMTP traffic until some of the offending traffic was recorded. I suspect you'll find the source of the messages doing that.

If you can actually get your hands on one of the offending messages look for a header similar to the following:

Received: from Your-Exchange-Server.domain.com ([1.1.1.1]) by
    Your-Exchange-Server.domain.com ([1.1.1.1]) with mapi; Mon, 16 Jan 2012
    14:47:40 -0500

Messages submitted w/ MAPI would have that header in an Exchange 2007 environment.

6
  • 1) I don't think it's that odd for a windows box to get malware that takes advantage of Outlook to send spam. 2) Server is not an open relay and is clean. 3) Messages were sent in an 8 hour window Sunday and have since stopped so sniffing isn't an option. 4) The only place I can get at the message is in the sent items in the mailbox which has no header. Do you know where I can find the message that would include the source workstation not the server? -Thanks Jan 17, 2012 at 15:06
  • @PaulAckerman: I haven't personally seen malware that uses MAPI to send email. I'm not saying it's not possible, but I've never seen such a thing. There would be no place to see that header except at the recipient's mailbox on the remote server, but since you're seeing them in the "Sent Items" folder of the mailbox I tend to think they were submitted via MAPI, though, and seeing the header is irrelevant (to me). To my knowledge there isn't anywhere in Exchange 2007 where you're going to find the IP address of the submitting client (assuming it was an Outlook / MAPI client). Jan 17, 2012 at 15:12
  • I was hoping there would be a header that included MAPI info internally but I'm starting to think not. I have one of the messages queued on my anti-spam box but the header only shows the internal mail server from which it received the message - not the workstation and even that header is stripped before leaving the door. Thanks for the help. I'm pretty sure I will not be able to leave this one in a state of "if it happens again, I'll do this" but it seems that I may not have any other choice... Jan 17, 2012 at 15:39
  • 1) I don't think it's that odd for a windows box to get malware that takes advantage of Outlook to send spam. - I do. It's not impossible but I'd say it was uncommon these days. It's not like Outlook is installed by default in Windows and that there's only one version of it, and I doubt that the code to handle all of that would end up more effective than the usual "open port 25, begin dumping crud" spam malware model. Spammers are nothing if not efficient.
    – Rob Moir
    Jan 17, 2012 at 16:02
  • 1
    Connection via exchange active sync protocol with someone's username and password would be how I'd do it, if I were in their line of business.
    – Rob Moir
    Jan 17, 2012 at 17:49
0

As Evan points out, MAPI-submitted is less likely than say open anonymous relayed SMTP.

If you have multiple receive connectors and have trouble figuring out where it came from, use the MessageId in the header to search for all events pertaining to this message in the Message Tracking Logs.

Either use the Get-MessageTrackingLogs cmdlet from EMS or open the Management Console, select Toolbox and then the Message Tracking Viewer. Clear the "events" checkbox and past in the MessageId to search for and see if any more information turns up.

You could also just search for messages sent by the apparently spoofed user in the time frame the SPAM was sent

1
  • The message Tracking logs do not show me which receive connector that received the message. The connector ID field is blank except for the outgoing connector that was used to deliver the message. Again, I don't think the messages were spoofed as 1) my receive connectors require auth and 2) the messages exist in sent items. Also, the SMTP protocol receive logs (the only connector that doesn't require auth but which does not allow relay anyway) on the mailhubs do not show the inbound connections. Jan 17, 2012 at 15:32

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .