Detect unexpected processes connecting out on FTP or SMTP ports

Siemphony@siemphonymediumT1048unverified

Matches outbound network connections on the classic bulk-transfer and mail ports (FTP control and data, TFTP, SMTP and its submission variants) initiated by a process that has no business speaking those protocols — a script interpreter, a transfer-capable living-off-the-land binary, or `ftp.exe` itself. The protocol is inferred from `DestinationPort` because that is the most specific field this log source carries; `Initiated` restricts the match to connections this host opened. MITRE's DataVolumeThresholdMB and time-of-day knobs are the real discriminators for exfiltration and neither is expressible in Sigma, so this rule fires on the channel rather than on the volume moving through it. UNVERIFIED AS AUTHORED — derived from MITRE ATT&CK DET0131, not hand-written and not tested by its author. Any lab result is on this rule's own page.Full description

The 2 SIEM queries below are previews produced by Siemphony’s own translator, not pySigma, and none has been executed against a real backend — review before you deploy.

detection.yml

Splunk · SPL

Run this as a search.

index=* ((Initiated="true" AND (DestinationPort="20" OR DestinationPort="21" OR DestinationPort="25" OR DestinationPort="69" OR DestinationPort="465" OR DestinationPort="587")) AND (Image="*\\powershell.exe" OR Image="*\\pwsh.exe" OR Image="*\\cmd.exe" OR Image="*\\wscript.exe" OR Image="*\\cscript.exe" OR Image="*\\mshta.exe" OR Image="*\\rundll32.exe" OR Image="*\\regsvr32.exe" OR Image="*\\certutil.exe" OR Image="*\\curl.exe" OR Image="*\\ftp.exe" OR Image="*\\tftp.exe" OR Image="*\\python.exe"))

Wazuh · XML rule

Deploy to your manager — this is a rule, not a search.

<group name="sigma,windows,network_connection,">  <!-- Rule ids must be unique on your manager; 100000+ is the user range. -->  <rule id="100000" level="7">    <!-- Set <if_sid> to the decoder/base rule for windows so this only evaluates relevant events. -->    <field name="Initiated" type="pcre2">(?i)^true$</field>    <field name="DestinationPort" type="pcre2">(?i)(^20$|^21$|^25$|^69$|^465$|^587$)</field>    <field name="Image" type="pcre2">(?i)(\\powershell\.exe$|\\pwsh\.exe$|\\cmd\.exe$|\\wscript\.exe$|\\cscript\.exe$|\\mshta\.exe$|\\rundll32\.exe$|\\regsvr32\.exe$|\\certutil\.exe$|\\curl\.exe$|\\ftp\.exe$|\\tftp\.exe$|\\python\.exe$)</field>    <description>Detect unexpected processes connecting out on FTP or SMTP ports</description>    <mitre>      <id>T1048</id>    </mitre>  </rule></group>

Sentinel · KQL

Run this as a search.

Sentinel cannot express this construct. `Initiated` has no Sentinel column: Defender expresses connection direction in `ActionType`, not as a boolean column, so `Initiated` cannot be renamed — it needs a different predicate. The Sigma source is on the first tab, unchanged.

Elastic · ES|QL

Run this as a search.

Elastic cannot express this construct. `Initiated` has no ECS field: ECS expresses connection direction as `network.direction` with values like `egress`, not as a boolean, so `Initiated` needs a different predicate rather than a rename. The Sigma source is on the first tab, unchanged.

At a glance

Logsource: network_connection / windows
Level: medium
Category: data_staging_exfil
Sigma status: experimental
Backends: 2 of 4 rendered
Updated: 30 Aug 2026
Rule ID: 9a29d4e9-f4cd-4101-9bcb-81cc927a4a5d

ATT&CKT1048

T1048Exfiltration Over Alternative Protocol

ATT&CK® is a registered trademark of The MITRE Corporation. These mappings are the rule author’s, and are neither reviewed nor endorsed by MITRE.

Lessondata staging exfil

data staging exfilAI draft — unreviewed

01 · What this rule detects

A Windows host opening an outbound connection to an FTP, TFTP or SMTP port from a process that has no business speaking those protocols. MITRE's analytic AN0367 describes "unusual outbound file transfer behavior … involving non-standard processes, off-hour activity, or uncommonly high volume." Three signals; Sigma can express one. Volume needs a sum over a connection, and off-hours needs a clock — neither is a field on a Sysmon event. So the rule keeps the non-standard process leg and fires on the channel, not on the data moving through it. That is the honest framing, and the rule's own description says so.

02 · Telemetry you need

Sysmon EventID 3 (Network Connection), the only Sysmon event carrying
A Sysmon config that does not exclude these processes from NetworkConnect.

03 · How the logic works

Three selections, all AND-ed:

Initiated: 'true' restricts to connections this host opened. Without it you also match inbound sockets, and an exfiltration story needs the host to be the caller. The port list is the protocol inference. Sysmon 3 has no protocol name field, so DestinationPort is the most specific thing available: 21 FTP control, 25/465/587 SMTP and its submission variants, 69 TFTP. Port 20 is in the list and the reviewer found it can never match — in active-mode FTP the server opens the data channel to the client, which Sysmon records as Initiated=false with SourcePort 20, and in passive mode the client dials an ephemeral port. Combined with selection_outbound, that branch is dead. It looks like FTP data-channel coverage and is not. Read it as a warning: a term can be syntactically perfect, render in four backends, and still be unreachable. Image|endswith rather than a full path, each value leading with \ so the separator is forced — \ftp.exe will not match myftp.exe. Pinning C:\Windows\System32\curl.exe would miss a copy dropped in %TEMP%, which is the case you actually care about.

04 · Common false positives

Sanctioned FTP. A nightly curl.exe or ftp.exe push to a partner or backup
Scripted mail. Send-MailMessage from monitoring and reporting jobs on 25 or
Build tooling: python.exe against a mirror, tftp.exe pushing firmware from

05 · Detection maturity

tier_1: .** UNVERIFIED — derived from MITRE ATT&CK DET0131 and never executed against a log line. level: medium is a judgement about the shape of the logic, not a measured false-positive rate; there is no measurement.
tier_2: confirm Sysmon 3 is actually collected for these images, run the rule over historical data, and turn your real transfer jobs into named allow-list entries.
tier_3: needs what Sigma cannot hold — MITRE's DataVolumeThresholdMB and TimeWindow — which means bytes-out aggregation in your correlation layer. And remember the evasion: send the data over 443. The protocol choice that defines the technique is also the whole of the bypass.

Tuning & false positivesexperimental · 3 declared

experimental (current stage)
test
stable

Written and reasoned about, but not yet run against real telemetry. Expect to tune it before trusting it.

Tuning tips

Populate MITRE's `ProtocolAllowList` knob — MITRE names the knob, the values
Drop port 20. It cannot fire.
The reviewer flagged two coverage holes worth deciding on deliberately: AN0367
The fourteen-image list does most of the FP suppression, so it is also most of
Before you trust the rendered query: the Sentinel translation targets

Declared by the author

Estates where FTP is a sanctioned transfer channel — a nightly curl.exe or ftp.exe push to a partner or backup host will match every run. This is exactly MITRE's ProtocolAllowList knob: pin the allowed process, destination and port triple per host rather than dropping the port from the list.
Scripted mail. Monitoring, ticketing and report jobs that call PowerShell's Send-MailMessage (or a Python smtplib script) against an internal relay on 25 or 587 are indistinguishable here from mail-based exfiltration; only the destination separates them.
Build and developer tooling. python.exe and curl.exe reaching a package mirror or an appliance that still offers FTP, and tftp.exe used for network device firmware pushes from a jump box.

Noise check0 of 2 fired

Fires on none of the 2 ordinary behaviours the baseline holds for this log type. That is not a precision guarantee: it means only not caught by these 2 behaviours, and the next ordinary behaviour nobody wrote down may still match.

Run live against 65 hand-written events of ordinary corporate activity — backup agents, software distribution, patching, helpdesk scripts, EDR. It says nothing about how often the rule would fire in production, which is the number that actually exhausts an analyst.

Verification1 run

Not verified

Siemphony benign baseline
completed
Siemphony IR · 3 Sept 2026
No events matched, so this run proves nothing either way.

Test it yourselfin your browser

Runs here in your browser against public attack recordings. A preview — not the verification badge.

Recordings of T1048, evaluated against their network_connection events.

Share this rule

/u/siemphony/9a29d4e9-f4cd-4101-9bcb-81cc927a4a5d

More from this repertoire

All compositions

Verdicts · reactions · comments

Community

Verdicts from engineers who actually deployed it, and the conversation around it.

Not yet reported on

Nobody has run this in a real environment and said what happened.

Verdicts from engineers who deployed it

0 cast

No verdicts reported yet. The first one is worth more than the tenth — say what you ran it against.

No comments yet. Someone who deploys this will have something to say about it.

Detect unexpected processes connecting out on FTP or SMTP ports

The detection

detection.yml

Splunk · SPL

Wazuh · XML rule

Sentinel · KQL

Elastic · ES|QL

Community

Verdicts from engineers who deployed it