Data Exfiltration via FTP

---

FTP (File Transfer Protocol) is one of the oldest protocols for transferring files between a client and server over a TCP/IP network. Attackers use it to move large amounts of data off a network, sometimes via compromised credentials, misconfigured servers, or ephemeral accounts. Detection relies on a mix of packet inspection (FTP only), server logs, SSH session metadata, and network flow/size/pattern analysis.

How adversaries use FTP for exfiltration

• Use legitimate FTP servers (public or misconfigured internal servers) to stage/transfer data.
• Use compromised credentials (service accounts, user creds).
• Use non-standard ports or tunneling to blend with other traffic.

Indicators of attack

What to look for:

• USER and PASS commands (cleartext credentials).
• STOR (upload) and RETR (download) commands: repeated or large transfers.
• Large data connections to unusual external IPs, especially outside business hours.
• Data channel openings on ephemeral ports (PASV) paired with large payloads.

Investigating with Wireshark

• Filter FTP control and data traffic: ftp || ftp-data
• Look for credentials
  • show login attempts with USER/PASS: ftp.request.command == "USER" || ftp.request.command == "PASS"
  • look for suspicious usernames or weak passwords
• Look for anomalies in filenames or credentials
  • ftp contains "STOR"
  • Right-click a packet → Follow → TCP Stream
• Look for suspicious files by file extension
  • e.g., ftp contains "csv"
• Identify large payload size
  • e.g., ftp && frame.len > 90
  • look for content in TCP Stream