Windows: ftp.exe Run with -s or /s Flag Leading to Arbitrary Command Execution

title: "Windows: ftp.exe Run with -s or /s Flag Leading to Arbitrary Command Execution"
id: 6fc511df-a1ba-42d0-a93e-c71b404c454e
status: test
description: This rule identifies process creation where ftp.exe is launched with the -s or /s flag, or where ftp.exe appears as the executing process. The -s script option can be used to automate FTP actions and may be abused to run attacker-controlled command sequences. Detection relies on Windows process creation telemetry, matching the parent image ending in ftp.exe and the command line containing the script flag.
references:
  - https://lolbas-project.github.io/lolbas/Binaries/Ftp/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_ftp_arbitrary_command_execution.yml
author: Victor Sergeev, oscd.community, Huntrule Team
date: 2020-10-09
modified: 2024-04-23
tags:
  - attack.execution
  - attack.stealth
  - attack.t1059
  - attack.t1202
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith: \ftp.exe
  selection_child_img:
    - Image|endswith: \ftp.exe
    - OriginalFileName: ftp.exe
  selection_child_cli:
    CommandLine|contains|windash: "-s:"
  condition: selection_parent or all of selection_child_*
falsepositives:
  - Unknown
level: medium
license: DRL-1.1
related:
  - id: 06b401f4-107c-4ff9-947f-9ec1e7649f1e
    type: derived