Potential Arbitrary Command Execution Via FTP.EXE Script

SigmaHQ Detections@sigmaHQ

•updated Aug 28, 2025•0•15

Detects the execution of 'ftp.exe' with the '-s' or '/s' flag, which indicates script execution, or any child processes spawned by 'ftp.exe'. This behavior can be abused by adversaries for arbitrary command execution, often as a method of defense evasion or indirect command execution.