Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
50 detections
Filters
Last updated
All Time
Detection languages
27
20
2
1
Contributors
25
8
6
3
3
Categories
20,425
11,812
5,870
5,145
4,864
Platforms
30
15
6
Products / Services
22
19
11
8
6
MITRE Techniques
21
17
13
8
6
CVEs
1
IDS Classtypes
11
5
2
2
IDS Protocols
14
5
1
Detects network events where FTP (port 21) traffic contains specific timestamp-like patterns in the RemoteUrl, which could indicate an attempt to exploit the Squidbleed vulnerability related to timestamp-to-filename parsing anomalies. The rule looks for 'LIST' command combined with '12:34:56', '2026-', or 'timestamp' in the URL.
Detects unusual FTP command sequences where common file listing commands (LIST, NLST, MLSD) are used without specifying a filename parameter, and the RemoteUrl length is unusually short, potentially indicating reconnaissance or an attempt to exploit a vulnerability like Squidbleed. The rule specifically excludes common file extensions to reduce false positives.
Detects execution of squid.exe with suspicious command line arguments
This rule detects potential exploitation of the Squidbleed vulnerability by identifying network connections to FTP port 21 where the remote URL contains 'PASV' or 'EPSV' commands, and the initiating process is 'squid.exe'. This indicates an attempt to abuse FTP passive mode through the Squid proxy.
This rule detects large data transfers over FTP, specifically looking for FTP data connections (flow:to_server,established) where the data size exceeds 65000 bytes. It uses a threshold of 10 such transfers within 60 seconds from the same source to trigger an alert, indicating potential data exfiltration. This aligns with MITRE ATT&CK technique T1048.003, which involves exfiltrating data over FTP.
FTP Used as C2 Command Channel
Suricata
This rule detects potential command and control (C2) activity over FTP by identifying a high frequency of 'RETR' (retrieve) commands. A threshold of 20 'RETR' commands within 60 seconds from the same source IP address triggers the alert. This pattern can indicate an attacker using FTP to download commands or tools from a C2 server.
This rule detects a potential FTP C2 (Command and Control) channel exhibiting a regular beaconing pattern. It triggers an alert if 10 or more TCP connections are made to port 21 (FTP) from a single source IP address within a 300-second window, indicating established communication from the internal network to an external FTP server. This behavior is characteristic of malware using FTP for C2 communications.
Detects the use of a renamed Rclone binary to exfiltrate data via FTP. This technique was observed in a Lunar Spider intrusion where the actor used 'sihosts.exe' (a renamed rclone.exe) to copy files to an actor-controlled FTP server.
Page 3 of 3