PCAP File Upload via FTP STOR to External Server

Arnold Chan@slaz

•updated Sep 4, 2026•0•0•2

Detects the use of the FTP 'STOR' command to transmit a file with the '.pcap' extension to an external network. This behavior is indicative of potential data exfiltration where captured network traffic is being uploaded to an attacker-controlled server.