During a network security investigation, an analyst uses the Wireshark filter smtp contains "RCPT TO" to examine email traffic. The analyst finds emails being sent to an external domain with 15 distinct recipients. What should the analyst investigate further?
Select an answer to reveal the explanation.
Short Explanation and Infographic
Here's the deal — b is correct because legitimate enterprise email flows through configured mail gateways; a workstation directly connecting to an external SMTP server and sending to many recipients indicates malware using the system as a spam relay, phishing sender, or using email for data exfiltration. A is wrong because the sending source matters; a mail server sending to 15 recipients is normal, but a workstation doing so is anomalous.
Full explanation below image
Full Explanation
B is correct because legitimate enterprise email flows through configured mail gateways; a workstation directly connecting to an external SMTP server and sending to many recipients indicates malware using the system as a spam relay, phishing sender, or using email for data exfiltration. A is wrong because the sending source matters; a mail server sending to 15 recipients is normal, but a workstation doing so is anomalous. C is wrong because recipient list membership doesn't address the suspicious sending behavior. D is wrong because while TLS encryption is a security concern for eavesdropping, the primary investigative concern is the unauthorized direct SMTP connection from a workstation.