ftp.exe abused via -s switch to execute hidden FTP script (QUICSILVER)
This rule detects the suspicious execution of the native Windows FTP utility ('ftp.exe') initiated by a shortcut file (.lnk). It specifically looks for the '-s' command-line switch, which is used to execute a script file for non-interactive FTP operations. This pattern is commonly observed in malware campaigns where an adversary uses a shortcut file to trigger a secondary stage of the attack by downloading payloads via FTP scripts.
Microsoft Sentinel (KQL)
