Cross-source coverage
T1071.002 / ATT&CK
Application Layer Protocol: File Transfer Protocols
2 rules across 2 sources.
From MITRE ATT&CK 19.2
Adversaries may communicate using application layer protocols associated with transferring files to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Protocols such as SMB, FTP, FTPS, and TFTP that transfer files may be very common in environments. Packets produced from these protocols may have many fields and headers in which data can be concealed. Data could also be concealed within the transferred files. An adversary may abuse these protocols to communicate with systems under their control within a victim network while also mimicking normal, expected traffic.
- Tactics
- Command and Control
- Platforms
- ESXi · Linux · macOS · Network Devices · Windows
- Telemetry
-
WinEventLog:SysmonNSM:Flowauditd:SYSCALLmacos:osquerymacos:unifiedlogesxi:shell
How MITRE says to detect it DET0416
Detection of File Transfer Protocol-Based C2 (FTP, FTPS, SMB, TFTP)
Windows Analytic 1169
Detects FTP, SMB, or TFTP traffic initiated by suspicious processes like PowerShell, cmd.exe, or rundll32.exe—especially with large outbound file transfers or unbalanced traffic volume.
WinEventLog:SysmonEventCode=3, 22WinEventLog:SysmonEventCode=1NSM:Flowftp.log, smb_files.log
Linux Analytic 1170
Detects usage of FTP, SCP, or TFTP by non-interactive shells or automation scripts transferring large data volumes to untrusted IPs.
auditd:SYSCALLexecveNSM:Flowftp.log, conn.log
macOS Analytic 1171
Detects Automator, AppleScript, or Terminal executing curl, lftp, or TFTP for binary transfer to untrusted IPs or unusual ports.
macos:osquerysocket_eventsmacos:unifiedloglog stream --predicate
ESXi Analytic 1172
Detects file movement or outbound TFTP/FTP transfers from ESXi host initiated via shell commands or injected scripts, particularly from scratch partitions or /tmp.
esxi:shell/root/.ash_historyNSM:Flowmirror/SPAN port
Network Devices Analytic 1173
Detects internal hosts generating large outbound FTP/TFTP/SMB sessions to external IPs, or file transfers using non-standard ports and application mismatches (e.g., FTP over port 80).
NSM:Flowftp.log, conn.log, smb_files.log
Wazuh Core Ruleset
1 rule| Detection | Severity | Format |
|---|---|---|
| MS-FTP: Multiple FTP errors from same source. | High | Wazuh XML |
splunk/security_content
1 rule| Detection | Severity | Format |
|---|---|---|
| Detect Outbound SMB Traffic | Undefined | SPL |