Router PCAP Exfiltration via FTP STOR to External Host

Arnold Chan@slaz

•updated Sep 4, 2026•0•0•4

Detects the FTP STOR command uploading a file with a .pcap extension to an external host on port 21 or 20 — consolidated from three overlapping detections (generic server, router-specific, and capture-file variants). Indicates an adversary (e.g. Fire Ant/UNC3886) exfiltrating captured network traffic from a compromised network device via FTP.