Question

While reviewing a PCAP of an SMTP session in Wireshark, an analyst follows the TCP stream and sees the server response '250 OK' after the client issues 'MAIL FROM:' and 'RCPT TO:'. The DATA section contains a 'From:' header of 'PayPal Billing '. Which observation is the MOST relevant intrusion analysis finding?

Accepted Answer

The SMTP envelope sender (MAIL FROM) domain 'paypa1-secure.com' does not match the display From header 'paypal.com', indicating email spoofing

Answer

The '250 OK' server response confirms the message was rejected as spam by the receiving server

Answer

The RCPT TO command reveals that the message used TLS encryption to hide its recipient

Answer

The presence of a DATA section proves the message contained a malicious file attachment