dictionary attack

[darin.marais]

Are there “mail server dictionary attack” signatures within the s94 signature set?

ref;

http://isc.sans.org/diary.php?date=2004-06-01

[mcerha]

We do not currently have any signatures that would identify the "attack" probably being used by the spammers. I will add this to our list of potential signatures.

[darin.marais]

Marco, I may have a network that could be very well under this type of an attack. I would like to show value from the NIDS in this area. Do you or anyone on the list have any custom signatures that could help in the interim to identify sources of a "mail dictionary attack" directed towards an exchange 5.5 server?