ATT&CK T1110.001 - FTP Brute Force Detected

Darshan Thummar@Mighty

•updated Jun 10, 2026•0•0•3

This rule detects an FTP brute force attempt by monitoring TCP connections to port 21 (FTP) on the home network. It triggers an alert if 20 or more TCP SYN packets (indicating new connection attempts) are observed from the same source IP address within a 60-second window. This behavior is indicative of an attacker repeatedly trying to guess FTP credentials.