SFTP Used as Covert C2 Data Channel

Darshan Thummar@Mighty

•updated Jun 12, 2026•0•0•3

This rule detects the use of SFTP (Secure File Transfer Protocol) as a covert command and control (C2) data channel. It specifically looks for TCP traffic on port 22 (SFTP's default port) with a specific content pattern ('|00 00 00|') within the first 4 bytes of the payload, a payload size between 100 and 500 bytes, and a high frequency (20 times in 60 seconds) from a single source IP address. This pattern and frequency could indicate an attempt to exfiltrate data or maintain C2 communication disguised as legitimate SFTP traffic.