FTP Used as C2 Command Channel

Darshan Thummar@Mighty

•updated Jun 12, 2026•0•0•2

This rule detects potential command and control (C2) activity over FTP by identifying a high frequency of 'RETR' (retrieve) commands. A threshold of 20 'RETR' commands within 60 seconds from the same source IP address triggers the alert. This pattern can indicate an attacker using FTP to download commands or tools from a C2 server.