ATT&CK T1048.003 - FTP Data Exfiltration: Large Transfer

Darshan Thummar@Mighty

•updated Jun 10, 2026•1•0•6

This rule detects large data transfers over FTP, specifically looking for FTP data connections (flow:to_server,established) where the data size exceeds 65000 bytes. It uses a threshold of 10 such transfers within 60 seconds from the same source to trigger an alert, indicating potential data exfiltration. This aligns with MITRE ATT&CK technique T1048.003, which involves exfiltrating data over FTP.