Network Connection to FTP with Suspicious URL Keywords

nomit vyas@xoxo

•updated Jun 24, 2026•0•0•1

This rule detects network connections made over FTP (port 21) where the remote URL contains keywords often associated with legacy or specific network services like 'NetWare', 'NFS', or 'Novell', combined with the presence of multiple spaces or specific whitespace indicators. This combination could indicate an attempt to interact with or exploit older network protocols or systems, potentially for reconnaissance or data exfiltration.