Detect FTP or TFTP connection from a script host or proxy binary

Siemphony@siemphonyhighT1071.002unverified

Matches an outbound Sysmon network connection to an FTP, FTPS or TFTP port where the process that opened the socket is a script host or a signed-binary proxy rather than a file-transfer client — AN1169's "suspicious process initiating file-transfer traffic" leg, expressed with the three fields Sysmon EventID 3 actually carries (`Initiated`, `DestinationPort`, `Image`). Two parts of the analytic are deliberately absent. SMB is not in the port list: the Windows SMB client redirector runs in kernel mode, so Sysmon attributes port 139/445 connections to `System`, not to the script host that triggered them, and an `Image`-gated port-445 selection would look like SMB coverage while matching almost nothing. `cmd.exe`, `ftp.exe` and `bitsadmin.exe` are absent for the same class of reason — cmd.exe opens no sockets of its own, ftp.exe is the standard client MITRE's ProcessImageFilter knob points away from, and a BITS job is carried by the service host, not by bitsadmin.exe. The image list is that knob populated here with hosts that do open their own sockets; MITRE's own examples in the knob are cmd and mshta. MITRE's DataFlowDirectionThreshold and FilenamePattern knobs are a byte-ratio and a filename, neither of which exists in EventID 3 and neither of which Sigma can compute, so this rule fires on the connection alone and the analyst sizes the transfer elsewhere. Prerequisite: Sysmon EventID 3 is only produced where the running Sysmon config includes a matching NetworkConnect rule, and the widely used community configs filter it hard and several drop UDP outright — which would silently blind the TFTP (port 69) arm. UNVERIFIED AS AUTHORED — derived from MITRE ATT&CK DET0416, not hand-written and not tested by its author. Any lab result is on this rule's own page.Full description

The 2 SIEM queries below are previews produced by Siemphony’s own translator, not pySigma, and none has been executed against a real backend — review before you deploy.

detection.yml

Splunk · SPL

Run this as a search.

index=* ((Initiated="true" AND (DestinationPort="20" OR DestinationPort="21" OR DestinationPort="69" OR DestinationPort="989" OR DestinationPort="990")) AND (Image="*\\powershell.exe" OR Image="*\\pwsh.exe" OR Image="*\\wscript.exe" OR Image="*\\cscript.exe" OR Image="*\\mshta.exe" OR Image="*\\rundll32.exe" OR Image="*\\regsvr32.exe" OR Image="*\\certutil.exe" OR Image="*\\curl.exe" OR Image="*\\tftp.exe"))

Wazuh · XML rule

Deploy to your manager — this is a rule, not a search.

<group name="sigma,windows,network_connection,">  <!-- Rule ids must be unique on your manager; 100000+ is the user range. -->  <rule id="100000" level="12">    <!-- Set <if_sid> to the decoder/base rule for windows so this only evaluates relevant events. -->    <field name="Initiated" type="pcre2">(?i)^true$</field>    <field name="DestinationPort" type="pcre2">(?i)(^20$|^21$|^69$|^989$|^990$)</field>    <field name="Image" type="pcre2">(?i)(\\powershell\.exe$|\\pwsh\.exe$|\\wscript\.exe$|\\cscript\.exe$|\\mshta\.exe$|\\rundll32\.exe$|\\regsvr32\.exe$|\\certutil\.exe$|\\curl\.exe$|\\tftp\.exe$)</field>    <description>Detect FTP or TFTP connection from a script host or proxy binary</description>    <mitre>      <id>T1071.002</id>    </mitre>  </rule></group>

Sentinel · KQL

Run this as a search.

Sentinel cannot express this construct. `Initiated` has no Sentinel column: Defender expresses connection direction in `ActionType`, not as a boolean column, so `Initiated` cannot be renamed — it needs a different predicate. The Sigma source is on the first tab, unchanged.

Elastic · ES|QL

Run this as a search.

Elastic cannot express this construct. `Initiated` has no ECS field: ECS expresses connection direction as `network.direction` with values like `egress`, not as a boolean, so `Initiated` needs a different predicate rather than a rename. The Sigma source is on the first tab, unchanged.

At a glance

Logsource: network_connection / windows
Level: high
Category: reverse_shell
Sigma status: experimental
Backends: 2 of 4 rendered
Updated: 30 Aug 2026
Rule ID: e593c7e5-0706-4e43-8c30-8ddb06beb58e

ATT&CKT1071.002

T1071.002File Transfer Protocols

ATT&CK® is a registered trademark of The MITRE Corporation. These mappings are the rule author’s, and are neither reviewed nor endorsed by MITRE.

Lessonreverse shell

reverse shellAI draft — unreviewed

01 · What this rule detects

An outbound connection to an FTP, FTPS or TFTP port where the process that opened the socket is a script host or a signed-binary proxy rather than a file-transfer client. MITRE's AN1169 wants "FTP, SMB, or TFTP traffic initiated by suspicious processes ... especially with large outbound file transfers or unbalanced traffic volume". Two of its three knobs carry the part that makes it C2: DataFlowDirectionThreshold is a byte ratio, FilenamePattern is a filename, and Sysmon EventID 3 has neither. Only ProcessImageFilter — MITRE's examples being cmd and mshta — lands in a single event. Stripped of volume and direction, this is a protocol-anomaly signal shared by T1071.002 (C2), T1105 (tool ingress) and T1048 (exfiltration over an alternate protocol). The title says C2; the evidence says "a script host touched an FTP port".

02 · Telemetry you need

Sysmon EventID 3, produced only where the running config includes a matching NetworkConnect rule. The community configs filter it hard and several drop UDP outright — silently blinding the TFTP arm on port 69.
sentinel_kql is refused because Initiated has no Defender column; direction lives in ActionType there. The translator was right to refuse rather than ship a query that drops the direction gate.

03 · How the logic works

The exclusions show real understanding of EventID 3. SMB is left out because the Windows redirector runs in kernel mode, so Sysmon attributes port 445 to System, not the script host that triggered it — an Image-gated 445 selection would look like SMB coverage and match almost nothing. cmd.exe opens no sockets of its own. A BITS job is carried by the service host, not bitsadmin.exe. Check the binary is the one that opened the socket, not the one you typed. The same reasoning is then applied to ftp.exe, and there it breaks. wscript.exe and cscript.exe have no native FTP stack — a WSH transfer script drives ftp.exe or a COM wrapper, and Sysmon attributes the socket to that child, which this rule excludes by design. mshta.exe and regsvr32.exe are the same: their remote-load paths speak HTTP(S) and UNC, not FTP. Four of the ten image terms can never fire. The rule then convicts itself. Its first false positive describes legacy automation uploading to a partner FTP endpoint "from PowerShell or a VBScript wrapper" — and the VBScript half is a scenario the rule structurally cannot match. When a rule's own false positive describes something it cannot fire on, the selection and the reasoning have drifted apart. Pick one: add \ftp.exe (ftp.exe -s:script.txt is the canonical Windows-native FTP vehicle, and unusual on a workstation), or drop the four dead terms. Effective coverage today is powershell, pwsh, curl, certutil and tftp. DestinationPort: 20 is dead too. In active-mode FTP the server opens the data channel, so on the client that event carries Initiated: false and an ephemeral port; in passive mode it goes to a random high port. Only the control channel (21/989/990) and TFTP (69) are observable — the payload-bearing data channel is invisible to a port-list rule.

04 · Common false positives

Legacy in-house automation uploading to partner or bank FTP/FTPS endpoints
Network engineering using the native TFTP client to push switch firmware —
curl.exe in CI scripts pulling from an internal FTP mirror. It ships with
certutil.exe fetching a CRL from an FTP URL.
The missed one: scripted administration of internal legacy appliances —

05 · Detection maturity

tier_1: .** UNVERIFIED — derived from MITRE ATT&CK DET0416 and never executed against a single log line.
tier_2: confirm your Sysmon config emits EventID 3 for UDP at all, and check whether wscript, cscript, mshta or regsvr32 ever produced a single match.
tier_3: needs the byte-ratio and filename evidence AN1169 describes — Zeek ftp.log, also in the brief, rather than this source.

Tuning & false positivesexperimental · 4 declared

experimental (current stage)
test
stable

Written and reasoned about, but not yet run against real telemetry. Expect to tune it before trusting it.

Tuning tips

level: high does not survive the rule's own text, which says tftp.exe "will dominate the port-69 matches" and that curl.exe against internal mirrors is "ordinary tooling". A rule you expect to be dominated by network engineering and build traffic is a triage-queue item. Drop to medium, or narrow the image list to hosts with no legitimate file-transfer role and split curl.exe and tftp.exe into a lower-severity rule.
Add an internal/external destination split — the highest-value change, and it removes the appliance volume wholesale. Baseline by destination IP and account, the practical stand-in for MITRE's DataFlowDirectionThreshold knob.
Both gates are closed allowlists: FTP C2 on port 2121, or from a binary outside the ten, defeats this with one change on either axis.

Declared by the author

Legacy in-house automation that uploads to a partner or bank FTP/FTPS endpoint from PowerShell or a VBScript wrapper. This is the single largest source of benign volume in older estates, it runs under a service account at fixed times, and at the EventID 3 level it is byte-for-byte the same event as an operator staging a collection archive. Baseline by destination IP and by the account, which is the practical stand-in for MITRE's DataFlowDirectionThreshold knob that this rule cannot evaluate.
Network engineering work with the native TFTP client. Pushing switch firmware or pulling a router configuration to a local TFTP server produces tftp.exe to port 69, which is otherwise the strongest single term in the rule, so an estate with network staff will see this term dominate the port-69 matches.
curl.exe in build, packaging and CI scripts pulling artefacts from an internal FTP mirror. curl.exe ships with Windows now, so this is ordinary tooling rather than a dropped binary, and nothing in the connection event distinguishes the mirror from an operator's staging host.
rundll32.exe acting as a generic host for a third-party DLL that does its own FTP transfer, and certutil.exe fetching a CRL or certificate bundle from a URL that happens to be FTP. Both are the legitimate purpose of the binary rather than proxy execution.

Noise check0 of 2 fired

Fires on none of the 2 ordinary behaviours the baseline holds for this log type. That is not a precision guarantee: it means only not caught by these 2 behaviours, and the next ordinary behaviour nobody wrote down may still match.

Run live against 65 hand-written events of ordinary corporate activity — backup agents, software distribution, patching, helpdesk scripts, EDR. It says nothing about how often the rule would fire in production, which is the number that actually exhausts an analyst.

Verification1 run

Not verified

Siemphony benign baseline
completed
Siemphony IR · 3 Sept 2026
No events matched, so this run proves nothing either way.

Test it yourselfin your browser

Runs here in your browser against public attack recordings. A preview — not the verification badge.

Recordings of T1071.002, evaluated against their network_connection events.

Share this rule

/u/siemphony/e593c7e5-0706-4e43-8c30-8ddb06beb58e

More from this repertoire

All compositions

Verdicts · reactions · comments

Community

Verdicts from engineers who actually deployed it, and the conversation around it.

Not yet reported on

Nobody has run this in a real environment and said what happened.

Verdicts from engineers who deployed it

0 cast

No verdicts reported yet. The first one is worth more than the tenth — say what you ran it against.

No comments yet. Someone who deploys this will have something to say about it.

Detect FTP or TFTP connection from a script host or proxy binary

The detection

detection.yml

Splunk · SPL

Wazuh · XML rule

Sentinel · KQL

Elastic · ES|QL

Community

Verdicts from engineers who deployed it