Hide Navigation Hide TOC

Potential Arbitrary Command Execution Via FTP.EXE (06b401f4-107c-4ff9-947f-9ec1e7649f1e)

Detects execution of "ftp.exe" script with the "-s" or "/s" flag and any child processes ran by "ftp.exe".

Cluster A	Galaxy A	Cluster B	Galaxy B	Level
Indirect Command Execution - T1202 (3b0e52ce-517a-4614-a523-1bd5deef6c5e)	Attack Pattern	Potential Arbitrary Command Execution Via FTP.EXE (06b401f4-107c-4ff9-947f-9ec1e7649f1e)	Sigma-Rules	1
Potential Arbitrary Command Execution Via FTP.EXE (06b401f4-107c-4ff9-947f-9ec1e7649f1e)	Sigma-Rules	Command and Scripting Interpreter - T1059 (7385dfaf-6886-4229-9ecd-6fd678040830)	Attack Pattern	1