Windows: Detect ftp.exe Executed With -s or /s for Script-Based Command Execution
Flags Windows executions of ftp.exe using -s or /s, indicating potential scripted command abuse.
- Product
- windows
- Category
- process_creation
- Author
- Victor Sergeev, oscd.community (SigmaHQ), DRL 1.1
- Published
- 2020-10-09
- Updated
- 2026-07-31
ATT&CK techniques
Execution → Defense EvasionRecon
Resource Dev
Initial Access
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule flags cases where ftp.exe is launched as a process and indicates potential script-driven execution via the -s or /s command-line flag. Attackers can use ftp.exe to run scripted actions that may launch additional processes, so correlating ftp.exe activity with child processes increases confidence. The detection relies on Windows process creation telemetry, matching parent image details and child process command-line and image/filename indicators related to ftp.exe.
Reporting behind it
Changelog
v2- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: "Windows: Detect ftp.exe Executed With -s or /s for Script-Based Command Execution"
id: 6fc511df-a1ba-42d0-a93e-c71b404c454e
status: test
description: This rule flags cases where ftp.exe is launched as a process and indicates potential script-driven execution via the -s or /s command-line flag. Attackers can use ftp.exe to run scripted actions that may launch additional processes, so correlating ftp.exe activity with child processes increases confidence. The detection relies on Windows process creation telemetry, matching parent image details and child process command-line and image/filename indicators related to ftp.exe.
references:
- https://lolbas-project.github.io/lolbas/Binaries/Ftp/
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_ftp_arbitrary_command_execution.yml
author: Victor Sergeev, oscd.community, Huntrule Team
date: 2020-10-09
modified: 2024-04-23
tags:
- attack.execution
- attack.stealth
- attack.t1059
- attack.t1202
logsource:
category: process_creation
product: windows
detection:
selection_parent:
ParentImage|endswith: \ftp.exe
selection_child_img:
- Image|endswith: \ftp.exe
- OriginalFileName: ftp.exe
selection_child_cli:
CommandLine|contains|windash: "-s:"
condition: selection_parent or all of selection_child_*
falsepositives:
- Unknown
level: medium
license: DRL-1.1
related:
- id: 06b401f4-107c-4ff9-947f-9ec1e7649f1e
type: derived