Forensic Analysis of Cisco ESA Double Bounce Syslogs

When managing enterprise email infrastructure, defending against unsolicited spam attacks and spoofing is a daily operational challenge. A common attack pattern involves malicious senders transmitting spam to invalid internal recipients with spoofed return addresses (often pointing to public providers like Microsoft Outlook).

When your mail gateway rejects the message, it attempts to send a non-delivery report (NDR) back to the spoofed sender. If the spoofed address is also invalid or rejects the NDR, a double bounce occurs.

In this guide, I will share an advanced forensic Bash script used to parse Cisco Email Security Appliance (ESA) syslogs, correlate double bounced Message IDs (MIDs), extract source IPs and sender addresses, and automatically transmit audit reports via mailx.

Prerequisites

You will need a Linux administrative control node with access to centralized Cisco ESA syslogs (/syslog/ESA/), alongside standard text processing utilities (grep, awk).

---

Step 1: Understanding Cisco ESA Log Chaining

Cisco ESA tracks email transactions by chaining three core identifiers:

• ICID (Injection Connection ID): The initial TCP connection established by the sending MTA.
• MID (Message ID): The internal ID assigned to the specific message payload during processing.
• DCID (Delivery Connection ID): The outbound connection established when delivering the message.

When a double bounce occurs, the ESA generates a new internal MID to handle the bounce report. To identify the true source of the spam, we must trace this bounce MID backward to discover the original message MID and its corresponding ingress ICID.

---

Step 2: The Automated Forensic Script (bounce-tracker.sh)

Below is a complete forensic auditing script. It scans the ESA syslog for double bounced messages targeting Outlook, extracts the bounce MIDs, correlates them backward to discover the original sender IP, recipient address, and subject line, and outputs a clean CSV report.

Create the script /usr/local/bin/bounce-tracker.sh:

#!/bin/bash
# /usr/local/bin/bounce-tracker.sh
# Forensic script to track double bounced MIDs sending spam to Outlook

LOGFILE="/syslog/ESA/east-esa_syslog10"
DENY_LIST="/home/wazeem/denied-address.txt"
REPORT_CSV="/home/wazeem/denied-address-report.csv"

# 1. Extract all double bounced MIDs targeting Outlook
cat $LOGFILE | grep -i double | grep -i outlook | awk '{print $10}' > $DENY_LIST

# 2. Initialize CSV Report Header
echo "OriginalMID,OriginalICID,SourceIP,SenderAddress,RecipientAddress,Subject,MessageID" > $REPORT_CSV

# 3. Loop through each bounce MID and trace backward
for MID in $(cat $DENY_LIST)
do 
    # Find Original MID that generated the bounce
    OriginalMID=$(cat $LOGFILE | grep $MID | grep 'was generated' | awk '{print $15}')
    
    # Find Ingress ICID of the Original MID
    OriginalICID=$(cat $LOGFILE | grep $OriginalMID | grep Start | awk '{print $11}')
    
    # Find Source IP of the Ingress ICID
    SourceIP=$(cat $LOGFILE | grep $OriginalICID | grep New | awk '{print $15}')
    
    # Find Original Sender Address
    SenderAddress=$(cat $LOGFILE | grep $OriginalMID | grep 'From: ' | awk '{print $12}')
    
    # Find Original Target Recipient Address
    RecipientAddress=$(cat $LOGFILE | grep $OriginalMID | grep 'To: ' | awk '{print $14}')
    
    # Find Message Subject
    Subject=$(cat $LOGFILE | grep $OriginalMID | grep 'Subject ' | awk '{print $10 $11}')
    
    # Find Public Message-ID Header
    MessageID=$(cat $LOGFILE | grep $OriginalMID | grep 'Message-ID' | awk '{print $10}')

    # Append correlated data to CSV report
    echo "$OriginalMID,$OriginalICID,$SourceIP,$SenderAddress,$RecipientAddress,$Subject,$MessageID" >> $REPORT_CSV
done

# 4. Transmit audit report via mailx
echo "Forensic double bounce audit report attached." | mailx -a $REPORT_CSV -s "Forensic Audit: Double Bounced Spam targeting Outlook" -r security-audit@induslevel.com security-audit@induslevel.com

---

Step 3: Manual Forensic One-Liners Cheatsheet

If you need to investigate a specific spam attack instantly without running the full loop script, utilize these targeted one-liners:

1. Extract Recipient Addresses for all Denied MIDs

while read I; do cat /syslog/ESA/east-esa_syslog10 | grep "$I" | grep 'To:' | awk '{print $8","$14}'; done < /home/wazeem/denied-address.txt >> /home/wazeem/denied-recipient-address.txt

2. Trace Original MID from a Specific Bounce MID (386651185)

OriginalMID=$(cat /syslog/ESA/east-esa_syslog10 | grep 386651185 | grep 'was generated' | awk '{print $15}')
echo $OriginalMID

3. Extract Source IP from Original MID (828264589)

cat /syslog/ESA/east-esa_syslog10 | grep 828264589 | grep New | awk '{print $15}'

References

• Cisco Email Security Appliance Logging Reference