Where can I see all emails send by my Windows 2012 Server?

Solution 1:

You don't need a mail server installed to send email. SMTP is a simple protocol that connects to TCP port 25 of a remote server and delivers the message. Any process on a compromised server could do that.

You could start by using netstat -b -n -o to list the current connections and the processes involved in creating them. Or PowerShell Get-NetTCPConnection which can filter the listing based on the port with -RemotePort 25. E.g.

Get-NetTCPConnection -RemotePort 25 | Select-Object -Property LocalPort, RemoteAddress,
    @{ Name = 'ProcessName'; Expression = { (Get-Process -Id $_.OwningProcess).Name } },
    @{ Name = 'PID'; Expression = 'OwningProcess' }

This analysis might help you to find out how you got infected. However, eventually this will come back to question: How do I deal with a compromised server?