Suspicious File Transfer Utility Execution

Tim Peck@timpeck

•updated Aug 20, 2025•3•1•130

Detects the execution of legitimate file transfer or backup utilities like FileZilla (fzsftp.exe), Restic, or BackBlaze (b2.exe) that have been observed being abused by threat actors for data exfiltration.