Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
7 detections
Filters
Last updated
All Time
Detection languages
7
Contributors
4
2
1
Categories
5
4
4
2
2
Platforms
6
1
Products / Services
6
4
2
1
1
MITRE Techniques
4
4
2
1
1
IDS Classtypes
6
1
IDS Protocols
2,431
868
408
324
97
7
Detects FileZilla FTP client traffic patterns and large single-session outbound FTP transfers to external hosts above a tuned threshold, weighted more heavily outside business hours, excluding known internal FTP servers/vendors and approved data-transfer partners.
Detects the use of the FTP STOR command to transfer files with sensitive extensions (.docx, .pdf, .xlsx, .zip, .7z) to external networks. This behavior is indicative of potential data exfiltration via an unencrypted alternative protocol.
This rule detects outbound FTP traffic containing the 'STOR' command, which is used in the FTP protocol to upload files to a remote server. This behavior is a common indicator of unauthorized data exfiltration.
Detects the use of the FTP STOR command to transfer files with sensitive extensions (.docx, .pdf, .xlsx, .zip, .7z) to external networks. This behavior is indicative of potential data exfiltration via an unencrypted alternative protocol.
This rule detects outbound FTP traffic containing the 'STOR' command, which is used in the FTP protocol to upload files to a remote server. This behavior is a common indicator of unauthorized data exfiltration.
FTP Used as C2 Command Channel
Suricata
This rule detects potential command and control (C2) activity over FTP by identifying a high frequency of 'RETR' (retrieve) commands. A threshold of 20 'RETR' commands within 60 seconds from the same source IP address triggers the alert. This pattern can indicate an attacker using FTP to download commands or tools from a C2 server.
This rule detects the transmission of cleartext credentials over FTP by looking for the "PASS " string in network traffic flowing to an FTP server on port 21. This indicates that a password is being sent without encryption, which is a security risk.