AN1169
Analytic 1169
Windows
Detects FTP, SMB, or TFTP traffic initiated by suspicious processes like PowerShell, cmd.exe, or rundll32.exe—especially with large outbound file transfers or unbalanced traffic volume.
WinEventLog:Sysmon
EventCode=3, 22
WinEventLog:Sysmon
EventCode=1
NSM:Flow
ftp.log, smb_files.log
[ProcessImageFilter]
Limit to non-standard FTP clients or suspicious binaries (e.g., cmd, mshta)
[DataFlowDirectionThreshold]
Ratio of outbound:inbound bytes; e.g., >90% outbound
[FilenamePattern]
Suspicious file extensions or naming (e.g., .zip, .rar, random hash names)
AN1170
Analytic 1170
Linux
Detects usage of FTP, SCP, or TFTP by non-interactive shells or automation scripts transferring large data volumes to untrusted IPs.
auditd:SYSCALL
execve
NSM:Flow
ftp.log, conn.log
[TransferSizeThreshold]
Bytes sent in FTP upload or SCP push
[CommandLinePatternMatch]
e.g., scp -r /var/log/* or ftp upload scripts
AN1171
Analytic 1171
macOS
Detects Automator, AppleScript, or Terminal executing curl, lftp, or TFTP for binary transfer to untrusted IPs or unusual ports.
macos:osquery
socket_events
macos:unifiedlog
log stream --predicate
[FilePathAccessed]
e.g., ~/Documents, ~/Library/logs/
[NetworkPortAnomaly]
Non-standard FTP/TFTP ports used (e.g., FTP over 443)
AN1172
Analytic 1172
ESXi
Detects file movement or outbound TFTP/FTP transfers from ESXi host initiated via shell commands or injected scripts, particularly from scratch partitions or /tmp.
esxi:shell
/root/.ash_history
NSM:Flow
mirror/SPAN port
[TransferTargetDomainOrIP]
Public IPs or domains not belonging to known ESXi mgmt infra
[SourceDirectoryFilter]
Monitor transfers from /tmp/, /etc/, /vmfs/volumes/
AN1173
Analytic 1173
Network Devices
Detects internal hosts generating large outbound FTP/TFTP/SMB sessions to external IPs, or file transfers using non-standard ports and application mismatches (e.g., FTP over port 80).
NSM:Flow
ftp.log, conn.log, smb_files.log
[AppLayerProtocolMatch]
e.g., FTP/SMB observed over uncommon ports
[OutboundDataRateThreshold]
Bytes transferred outside trusted subnets >100MB