FTP Cleartext Credentials Transmitted

Darshan Thummar@Mighty

•updated Jun 10, 2026•0•0•2

This rule detects the transmission of cleartext credentials over FTP by looking for the "PASS " string in network traffic flowing to an FTP server on port 21. This indicates that a password is being sent without encryption, which is a security risk.