Bulk Data Exfiltration over Plaintext FTP/TFTP to an External Host

let LookBack = 24h;
// THREAT: Bulk exfiltration over plaintext FTP/TFTP to an external destination (T1048.003)
let FtpPorts = dynamic([20, 21, 69]);
let FtpClients = dynamic(["ftp.exe", "tftp.exe", "winscp.exe", "filezilla.exe", "ncftpput.exe", "lftp", "ftp", "tftp"]);
let IsExternal = (ip: string) {
    ip matches regex @"^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}$"
    and not(ipv4_is_in_range(ip, "10.0.0.0/8"))
    and not(ipv4_is_in_range(ip, "172.16.0.0/12"))
    and not(ipv4_is_in_range(ip, "192.168.0.0/16"))
    and not(ipv4_is_in_range(ip, "127.0.0.0/8"))
    and not(ipv4_is_in_range(ip, "169.254.0.0/16"))
    and not(ipv4_is_in_range(ip, "100.64.0.0/10"))
};
// Signal 1: repeated outbound sessions to FTP/TFTP ports on a public destination
let ExternalFtpSessions = DeviceNetworkEvents
| where Timestamp > ago(LookBack)
| where ActionType in ("ConnectionSuccess", "ConnectionRequest")
| where RemotePort in (FtpPorts)
| where IsExternal(RemoteIP)
| summarize ConnectionCount = count(), FirstSeen = min(Timestamp), LastSeen = max(Timestamp),
    Ports = make_set(RemotePort, 8), Clients = make_set(InitiatingProcessFileName, 10),
    CommandLines = make_set(InitiatingProcessCommandLine, 10)
    by DeviceName, AccountName = InitiatingProcessAccountName, RemoteIP
| where ConnectionCount >= 5
| extend Signal = "ExternalPlaintextFtpSession";
// Signal 2: native FTP/TFTP client invoked with an upload verb or an ftp:// URL
let FtpClientUpload = DeviceProcessEvents
| where Timestamp > ago(LookBack)
| where FileName in~ (FtpClients)
    or ProcessCommandLine contains "ftp://"
    or ProcessCommandLine contains "FtpWebRequest"
| where ProcessCommandLine has_any ("put ", "mput", "STOR", "-T ", "--upload-file", "ftp://", "FtpWebRequest")
| summarize ConnectionCount = count(), FirstSeen = min(Timestamp), LastSeen = max(Timestamp),
    Clients = make_set(FileName, 10), CommandLines = make_set(ProcessCommandLine, 10)
    by DeviceName, AccountName, RemoteIP = ""
| extend Ports = dynamic([]), Signal = "FtpClientUploadCommand";
ExternalFtpSessions
| union FtpClientUpload
| sort by LastSeen desc

index=zeek sourcetype="zeek:ftp:json" command IN ("STOR", "APPE", "STOU")
| where NOT (cidrmatch("10.0.0.0/8", dest_ip) OR cidrmatch("172.16.0.0/12", dest_ip) OR cidrmatch("192.168.0.0/16", dest_ip) OR cidrmatch("127.0.0.0/8", dest_ip) OR cidrmatch("169.254.0.0/16", dest_ip) OR cidrmatch("100.64.0.0/10", dest_ip))
| eval UploadBytes = if(isnull(file_size), 0, file_size)
| eval FtpUser = if(isnull(user) OR user=="", "anonymous-or-unparsed", user)
| stats count as UploadCommands, sum(UploadBytes) as TotalBytes, values(arg) as UploadedPaths, values(FtpUser) as FtpUsers, values(command) as Commands, min(_time) as FirstSeen, max(_time) as LastSeen by src_ip, dest_ip, dest_port
| where UploadCommands >= 5 OR TotalBytes >= 52428800
| eval Signal = "ExternalPlaintextFtpUpload"
| eval FirstSeen = strftime(FirstSeen, "%Y-%m-%d %H:%M:%S"), LastSeen = strftime(LastSeen, "%Y-%m-%d %H:%M:%S")
| table FirstSeen, LastSeen, src_ip, dest_ip, dest_port, UploadCommands, TotalBytes, FtpUsers, UploadedPaths, Commands, Signal
| sort - TotalBytes

sequence by host.id with maxspan=30m
  [ process where event.type == "start" and (
      process.name : ("ftp.exe", "tftp.exe", "lftp", "ncftpput", "ftp", "tftp", "WinSCP.exe", "filezilla.exe") or
      process.command_line : ("*ftp://*", "*FtpWebRequest*", "*--upload-file*")
    ) ]
  [ network where event.type == "start" and
      destination.port in (20, 21, 69) and
      not cidrmatch(destination.ip, "10.0.0.0/8", "172.16.0.0/12", "192.168.0.0/16", "127.0.0.0/8", "169.254.0.0/16", "100.64.0.0/10") ]

SELECT
  sourceip AS SourceIP,
  destinationip AS DestinationIP,
  destinationport AS DestinationPort,
  COUNT(*) AS FlowCount,
  SUM(sourcebytes) AS BytesOut,
  SUM(destinationbytes) AS BytesIn,
  DATEFORMAT(MIN(starttime), 'YYYY-MM-dd HH:mm:ss') AS FirstSeen,
  DATEFORMAT(MAX(lastpackettime), 'YYYY-MM-dd HH:mm:ss') AS LastSeen
FROM flows
WHERE
  destinationport IN (20, 21, 69)
  AND NOT INCIDR('10.0.0.0/8', destinationip)
  AND NOT INCIDR('172.16.0.0/12', destinationip)
  AND NOT INCIDR('192.168.0.0/16', destinationip)
  AND NOT INCIDR('127.0.0.0/8', destinationip)
  AND NOT INCIDR('169.254.0.0/16', destinationip)
  AND NOT INCIDR('100.64.0.0/10', destinationip)
GROUP BY sourceip, destinationip, destinationport
HAVING SUM(sourcebytes) > 52428800 OR COUNT(*) >= 5
ORDER BY BytesOut DESC
LAST 24 HOURS

_sourceCategory=network/zeek/ftp
| json field=_raw "id.orig_h" as src_ip nodrop
| json field=_raw "id.resp_h" as dest_ip nodrop
| json field=_raw "id.resp_p" as dest_port nodrop
| json field=_raw "command" as ftp_command nodrop
| json field=_raw "arg" as ftp_arg nodrop
| json field=_raw "user" as ftp_user nodrop
| json field=_raw "file_size" as file_size nodrop
| where ftp_command in ("STOR", "APPE", "STOU")
| where !compareCIDRPrefix("10.0.0.0", dest_ip, toInt(8))
    and !compareCIDRPrefix("172.16.0.0", dest_ip, toInt(12))
    and !compareCIDRPrefix("192.168.0.0", dest_ip, toInt(16))
    and !compareCIDRPrefix("127.0.0.0", dest_ip, toInt(8))
    and !compareCIDRPrefix("100.64.0.0", dest_ip, toInt(10))
| toInt(file_size) as upload_bytes
| count as UploadCommands, sum(upload_bytes) as TotalBytes, values(ftp_arg) as UploadedPaths, values(ftp_user) as FtpUsers by src_ip, dest_ip, dest_port
| where UploadCommands >= 5 or TotalBytes >= 52428800
| sort by TotalBytes desc

rule plaintext_ftp_bulk_exfiltration {
  meta:
    author = "df00tech Detection Engineering"
    description = "Detects bulk data exfiltration over plaintext FTP/TFTP to an external destination"
    severity = "HIGH"
    mitre_attack_tactic = "Exfiltration"
    mitre_attack_technique = "T1048.003"
    created = "2026-08-29"

  events:
    $e.metadata.event_type = "NETWORK_CONNECTION"
    $e.network.direction = "OUTBOUND"
    $e.target.port in %ftp_ports
    not net.ip_in_range_cidr($e.target.ip, "10.0.0.0/8")
    not net.ip_in_range_cidr($e.target.ip, "172.16.0.0/12")
    not net.ip_in_range_cidr($e.target.ip, "192.168.0.0/16")
    not net.ip_in_range_cidr($e.target.ip, "127.0.0.0/8")
    not net.ip_in_range_cidr($e.target.ip, "169.254.0.0/16")
    not net.ip_in_range_cidr($e.target.ip, "100.64.0.0/10")
    $host = $e.principal.hostname
    $dest = $e.target.ip

  match:
    $host, $dest over 1h

  outcome:
    $session_count = count($e.metadata.id)
    $bytes_out = sum($e.network.sent_bytes)
    $ports = array_distinct($e.target.port)

  condition:
    $e and ($session_count >= 5 or $bytes_out > 52428800)
}

#event_simpleName=NetworkConnectIP4
| in(field="RemotePort", values=["20", "21", "69"])
| not cidr(RemoteAddressIP4, subnet=["10.0.0.0/8", "172.16.0.0/12", "192.168.0.0/16", "127.0.0.0/8", "169.254.0.0/16", "100.64.0.0/10"])
| groupBy([aid, ComputerName, RemoteAddressIP4, RemotePort], function=[count(as=ConnectionCount), min(timestamp, as=FirstSeen), max(timestamp, as=LastSeen), collect([ContextProcessId], limit=10)])
| ConnectionCount >= 5
| sort(ConnectionCount, order=desc)