FTP C2 Channel - Regular Beaconing Pattern

Darshan Thummar@Mighty

•updated Jun 12, 2026•0•0•1

This rule detects a potential FTP C2 (Command and Control) channel exhibiting a regular beaconing pattern. It triggers an alert if 10 or more TCP connections are made to port 21 (FTP) from a single source IP address within a 300-second window, indicating established communication from the internal network to an external FTP server. This behavior is characteristic of malware using FTP for C2 communications.