FTP (File Transfer Protocol) Activity to the Internet
This rule detects events that may indicate the use of FTP network connections to the Internet. The File Transfer Protocol (FTP) has been around in its current form since the 1980s. It can be a common and efficient procedure on your network to send and receive files. Because of this, adversaries will also often use this protocol to exfiltrate data from your network or download new tools. Additionally, FTP is a plain-text protocol which, if intercepted, may expose usernames and passwords. FTP activity involving servers subject to regulations or compliance standards may be unauthorized.
Elastic rule (View on GitHub)
1[metadata]
2creation_date = "2020/02/18"
3deprecation_date = "2021/04/15"
4maturity = "deprecated"
5updated_date = "2021/04/15"
6
7[rule]
8author = ["Elastic"]
9description = """
10This rule detects events that may indicate the use of FTP network connections to the Internet. The File Transfer
11Protocol (FTP) has been around in its current form since the 1980s. It can be a common and efficient procedure on your
12network to send and receive files. Because of this, adversaries will also often use this protocol to exfiltrate data
13from your network or download new tools. Additionally, FTP is a plain-text protocol which, if intercepted, may expose
14usernames and passwords. FTP activity involving servers subject to regulations or compliance standards may be
15unauthorized.
16"""
17false_positives = [
18 """
19 FTP servers should be excluded from this rule as this is expected behavior. Some business workflows may use FTP for
20 data exchange. These workflows often have expected characteristics such as users, sources, and destinations. FTP
21 activity involving an unusual source or destination may be more suspicious. FTP activity involving a production
22 server that has no known associated FTP workflow or business requirement is often suspicious.
23 """,
24]
25from = "now-9m"
26index = ["filebeat-*", "packetbeat-*", "logs-endpoint.events.*"]
27language = "kuery"
28license = "Elastic License v2"
29name = "FTP (File Transfer Protocol) Activity to the Internet"
30risk_score = 21
31rule_id = "87ec6396-9ac4-4706-bcf0-2ebb22002f43"
32severity = "low"
33tags = ["Elastic", "Host", "Network", "Threat Detection", "Command and Control"]
34timestamp_override = "event.ingested"
35type = "query"
36
37query = '''
38event.category:(network or network_traffic) and network.transport:tcp and (destination.port:(20 or 21) or event.dataset:zeek.ftp) and
39 source.ip:(
40 10.0.0.0/8 or
41 172.16.0.0/12 or
42 192.168.0.0/16
43 ) and
44 not destination.ip:(
45 10.0.0.0/8 or
46 127.0.0.0/8 or
47 169.254.0.0/16 or
48 172.16.0.0/12 or
49 192.168.0.0/16 or
50 224.0.0.0/4 or
51 "::1" or
52 "FE80::/10" or
53 "FF00::/8"
54 )
55'''
56
57
58[[rule.threat]]
59framework = "MITRE ATT&CK"
60
61[rule.threat.tactic]
62id = "TA0011"
63name = "Command and Control"
64reference = "https://attack.mitre.org/tactics/TA0011/"
65[[rule.threat]]
66framework = "MITRE ATT&CK"
67[[rule.threat.technique]]
68id = "T1048"
69name = "Exfiltration Over Alternative Protocol"
70reference = "https://attack.mitre.org/techniques/T1048/"
71
72
73[rule.threat.tactic]
74id = "TA0010"
75name = "Exfiltration"
76reference = "https://attack.mitre.org/tactics/TA0010/"
Related rules
- IRC (Internet Relay Chat) Protocol Activity to the Internet
- PPTP (Point to Point Tunneling Protocol) Activity
- Proxy Port Activity to the Internet
- SMTP to the Internet
- SQL Traffic to the Internet