Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
50 detections
Filters
Last updated
All Time
Detection languages
27
20
2
1
Contributors
25
8
6
3
3
Categories
20,424
11,812
5,870
5,145
4,864
Platforms
30
15
6
Products / Services
22
19
11
8
6
MITRE Techniques
21
17
13
8
6
CVEs
1
IDS Classtypes
11
5
2
2
IDS Protocols
14
5
1
Detects the SITE CPFR and SITE CPTO command sequence in ProFTPD logs, which is characteristic of exploiting the mod_copy vulnerability (CVE-2015-3306) to copy files without authentication.
Detects a sequence of FTP SITE CPFR (Copy From) followed by SITE CPTO (Copy To) commands from the same source IP and computer within 5 minutes, which can be abused to copy files on the server.
Detects ProFTPD FTP server commands where an adversary uses SITE CPFR (Copy From) to reference a sensitive file path (such as /etc/passwd or SSH keys) followed by SITE CPTO (Copy To) on the same host within a 10-minute window, which indicates potential staging or unauthorized copying of sensitive system files via FTP.
Detects the execution of the Windows FTP client (ftp.exe) using command-line arguments that include scripts (-s:), initiated by unconventional parent processes such as explorer.exe or cmd.exe. This behavior is often associated with the execution of automated FTP scripts for data exfiltration or malware delivery.
Detects specific FTP commands (STOR, RETR, TYPE I) and passive mode responses directed to or originating from identified malicious IP addresses associated with the LucidRook threat actor. This rule monitors for potential file exfiltration, payload retrieval, and command-and-control communication over the FTP protocol.
Detects the creation of a 'config.ini' file within the 'UBP-Asset' directory, correlated with subsequent FTP network activity from known associated binaries (UBPUpdater.exe, UBPPatch.Psh, cmd.exe, or UBP.exe). This behavioral pattern is indicative of Quasar RAT being delivered or updated through a fraudulent install path.
This rule detects the execution of the Windows FTP client (ftp.exe) using a command script file (via the -s: parameter). It monitors for process creation of ftp.exe with this flag, excluding known legitimate paths. It then correlates this with any child processes initiated by the FTP client to identify potential data exfiltration or automated file transfers.
Detects suspicious FTP command and control traffic originating from internal hosts to known compromised servers in Taiwan. The rules monitor for specific FTP commands such as STOR (to upload archive4.zip), RETR (to download archive1.zip), and initial authentication (USER command) associated with C2 communication.
Detects the creation of a 'config.ini' file within the 'UBP-Asset' directory, correlated with subsequent FTP network activity from known associated binaries (UBPUpdater.exe, UBPPatch.Psh, cmd.exe, or UBP.exe). This behavioral pattern is indicative of Quasar RAT being delivered or updated through a fraudulent install path.
Detects the creation of a 'config.ini' file within the 'UBP-Asset' directory, correlated with subsequent FTP network activity from known associated binaries (UBPUpdater.exe, UBPPatch.Psh, cmd.exe, or UBP.exe). This behavioral pattern is indicative of Quasar RAT being delivered or updated through a fraudulent install path.
Detects the creation of a 'config.ini' file within the 'UBP-Asset' directory, correlated with subsequent FTP network activity from known associated binaries (UBPUpdater.exe, UBPPatch.Psh, cmd.exe, or UBP.exe). This behavioral pattern is indicative of Quasar RAT being delivered or updated through a fraudulent install path.
Detects the creation of a 'config.ini' file within the 'UBP-Asset' directory, correlated with subsequent FTP network activity from known associated binaries (UBPUpdater.exe, UBPPatch.Psh, cmd.exe, or UBP.exe). This behavioral pattern is indicative of Quasar RAT being delivered or updated through a fraudulent install path.
Detects execution of processes associated with QuasarRAT or references to its configuration files, originating from or involving files and processes named 'UBPUpdater.exe' or 'UBPPatch.Psh'. Also identifies network connections via FTP or involving configuration files ('config.Ini') initiated by these specific processes, which may indicate malicious activity, command and control, or data exfiltration.
Detects the FTP STOR command uploading a file with a .pcap extension to an external host on port 21 or 20 — consolidated from three overlapping detections (generic server, router-specific, and capture-file variants). Indicates an adversary (e.g. Fire Ant/UNC3886) exfiltrating captured network traffic from a compromised network device via FTP.
Detects the use of the FTP 'STOR' command to transmit a file with the '.pcap' extension to an external network. This behavior is indicative of potential data exfiltration where captured network traffic is being uploaded to an attacker-controlled server.
Detects the execution of the Windows FTP client (ftp.exe) initiated by command-line interpreters such as cmd.exe, powershell.exe, or wscript.exe, specifically when utilizing the '-s:' flag. This flag is commonly used to provide a text file containing FTP commands, which is a frequent technique for automated file transfers or exfiltration during post-exploitation activities.
Detects the abuse of the Windows ftp.exe utility to execute a local script file provided via the -s flag. Adversaries may leverage this behavior, often triggered by malicious LNK files, to proxy the execution of commands or scripts.
Detects FTP STOR commands associated with the transfer of files with a .pcap extension, which may indicate the exfiltration of captured network traffic from a network device or server.
This rule detects the suspicious execution of the native Windows FTP utility ('ftp.exe') initiated by a shortcut file (.lnk). It specifically looks for the '-s' command-line switch, which is used to execute a script file for non-interactive FTP operations. This pattern is commonly observed in malware campaigns where an adversary uses a shortcut file to trigger a secondary stage of the attack by downloading payloads via FTP scripts.
Detects the use of the FTP STOR command to transfer files with sensitive extensions (.docx, .pdf, .xlsx, .zip, .7z) to external networks. This behavior is indicative of potential data exfiltration via an unencrypted alternative protocol.
Detects repeated use of the FTP 'STOR' command to transmit data to an external host within a short timeframe. The STOR command is used in the File Transfer Protocol (FTP) to upload a file to the server. An unusual frequency of this command toward external destinations may indicate data exfiltration.
Page 1 of 3