Windows FTP Exfiltration (PowerShell)

Group by: _time, host
Source: github.com/anvilogic-forge/armory

FTP is a utility commonly available with operating systems to transfer information over the File Transfer Protocol (FTP). Adversaries can use it to transfer other tools onto a system or to exfiltrate data

MITRE ATT&CK coverage

Tactic	Techniques
Command & Control	`T1071.002` Application Layer Protocol: File Transfer Protocols
Exfiltration	`T1048` Exfiltration Over Alternative Protocol

References

https://book.hacktricks.xyz/exfiltration

Telemetry coverage

Provider	Record / event type
PowerShell	Event ID 4104: Creating Scriptblock text (MessageNumber of MessageTotal).

Rule body

id: '5704.5966'
title: Windows FTP Exfiltration
description: 'FTP is a utility commonly available with operating systems to transfer
  information over the File Transfer Protocol (FTP). Adversaries can use it to transfer
  other tools onto a system or to exfiltrate data. - Threat Actor Association: APT35,
  Karakurt - Software Association: Agent Tesla, BianLian, Diavol, PureCrypter'
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_powershell` TERM(EventCode=4104) TERM(ftp)
  | regex process="(?i)ftp\s+(.{1,})?\-s\:.{1,}\.\w{2,5}" | table _time, host, user
  process, process_*, signature_id | bin span=1s | stats values(*) as * by _time,
  host '
techniques:
- command-and-control:application layer protocol:file transfer protocols
- exfiltration:exfiltration over alternative protocol
technique_id:
- T1071.002
- T1048
data_category:
- PowerShell logs
- Process command-line parameters
references:
- https://book.hacktricks.xyz/exfiltration

Stages and Predicates

Stage 1: `search`

`get_endpoint_data` `get_endpoint_data_powershell` TERM(EventCode=4104) TERM(ftp)

Stage 2: `regex`

| regex process="(?i)ftp\s+(.{1,})?\-s\:.{1,}\.\w{2,5}"

Stage 3: `table`

| table _time, host, user process, process_*, signature_id

Stage 4: `bucket`

| bin span=1s

Stage 5: `stats`

| stats values(*) as * by _time, host

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`EventCode`	eq	`4104` corpus 269 (splunk 269)	`field:"EventID" kind:eq value:"4104"`
`process`	regex_match	`"(?i)ftp\s+(.{1,})?\-s\:.{1,}.\w{2,5}"` corpus 3 (splunk 3)	`field:"CommandLine" kind:regex_match`

Search terms

These SPL tokens match against raw event text.

Stage	Term
1	`ftp`