T1071.002 — File Transfer Protocols

Tactic: Command and Control · Platforms: ESXi, Linux, macOS, Network Devices, Windows

Adversaries may communicate using application layer protocols associated with transferring files to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between…

Sub-technique of Application Layer Protocol (T1071).

Sigma detection rules (5)

T1071.002 Application Layer Protocol: File Transfer Protocols

title: "T1071.002 Application Layer Protocol: File Transfer Protocols"
id: d9e4f06a-dab5-4561-983b-2a485335af85
description: 'Detection of File Transfer Protocol-Based C2 (FTP, FTPS, SMB, TFTP). (Data Component: Network Connection Creation; baseline tier: windows-eventid.) Tune using: ProcessImageFilter, DataFlowDirectionThreshold, FilenamePattern.'
references:
  - https://attack.mitre.org/techniques/T1071/002
author: Shahrukh Khan
date: 2026-05-20
license: MIT
tags:
  - attack.command-and-control
  - attack.t1071.002

logsource:
  category: network_connection
  product: windows
  service: sysmon

detection:
  selection:
    EventID: '3'
    Initiated: 'true'
    DestinationPort:
      - 21
      - 69
      - 139
      - 445
      - 989
      - 990
    Image|endswith:
      - '\powershell.exe'
      - '\cmd.exe'
      - '\rundll32.exe'
      - '\certutil.exe'
  filter_system_proc:
    Image|endswith:
      - '\svchost.exe'
      - '\System'
  condition: selection and not filter_system_proc

falsepositives:
  - Legitimate admin FTP/SMB/TFTP transfers.

level: medium

T1071.002 Application Layer Protocol: File Transfer Protocols

title: "T1071.002 Application Layer Protocol: File Transfer Protocols"
id: a3272d52-e7d1-43b0-8e17-1ddb9cc3d314
description: 'Detection of File Transfer Protocol-Based C2 (FTP, FTPS, SMB, TFTP). (Retargeted to the process_creation auditd telemetry that actually captures this techniques behavior; see logsource below.) Fixed: added smbclient and tftp client invocations so SMB and TFTP, both explicitly named in the technique description, are covered alongside ftp/sftp/curl. Tune using: TransferSizeThreshold, CommandLinePatternMatch.'
references:
  - https://attack.mitre.org/techniques/T1071/002
author: Shahrukh Khan
date: 2026-05-07
modified: 2026-07-26
license: MIT
tags:
  - attack.command-and-control
  - attack.t1071.002

logsource:
  category: process_creation
  product: linux

detection:
  selection_ftp:
    type: EXECVE
    a0|endswith:
      - '/ftp'
      - '/sftp'
      - '/curl'
    a1|contains:
      - 'ftp://'
      - 'sftp://'
      - 'smb://'
  selection_smb:
    type: EXECVE
    a0|endswith: '/smbclient'
    a1|startswith:
      - '//'
      - 'smb://'
  selection_tftp:
    type: EXECVE
    a0|endswith: '/tftp'

  condition: 1 of selection_*

falsepositives:
  - FTP/SFTP/SMB/TFTP transfers are still used for legitimate batch file exchange in some environments (e.g. EDI, backups, network device firmware/config transfer via TFTP); the beaconing/size-threshold behavior described in the original tuning fields cannot be verified from a single EXECVE record alone.

level: low

T1071.002 Application Layer Protocol: File Transfer Protocols

title: "T1071.002 Application Layer Protocol: File Transfer Protocols"
id: 5db60c70-8dc5-403b-8c80-4aae75dd616c
description: 'Detection of File Transfer Protocol-Based C2 (FTP, FTPS, SMB, TFTP). (Retargeted to the process_creation macOS unified-log telemetry that actually captures this techniques behavior; see logsource below.) Tune using: FilePathAccessed, NetworkPortAnomaly.'
references:
  - https://attack.mitre.org/techniques/T1071/002
author: Shahrukh Khan
date: 2026-01-24
license: MIT
tags:
  - attack.command-and-control
  - attack.t1071.002

logsource:
  category: process_creation
  product: macos

detection:
  selection:
    Image|endswith:
      - '/ftp'
      - '/tftp'
      - '/sftp'

  condition: selection

falsepositives:
  - System administrators using ftp or sftp for legitimate file transfers to approved servers.

level: medium

T1071.002 Application Layer Protocol: File Transfer Protocols

title: "T1071.002 Application Layer Protocol: File Transfer Protocols"
id: 90ffe3c4-5c2f-4687-9370-76e1ae9cfde7
description: 'Detection of File Transfer Protocol-Based C2 (FTP, FTPS, SMB, TFTP). (Data Component: Network Traffic Content; baseline tier: fallback.) Tune using: AppLayerProtocolMatch, OutboundDataRateThreshold.'
references:
  - https://attack.mitre.org/techniques/T1071/002
author: Shahrukh Khan
date: 2026-06-12
license: MIT
tags:
  - attack.command-and-control
  - attack.t1071.002

logsource:
  product: nsm
  service: flow

detection:
  selection_dns_service:
    service: 'dns'
  selection_high_volume:
    orig_bytes|gte: 5000
  filter_local_resolver:
    id.resp_h: '127.0.0.1'

  condition: selection_dns_service and selection_high_volume and not filter_local_resolver

falsepositives:
  - Bulk zone transfers or legitimate DNS-based software update checks that transfer large records.

level: medium

T1071.002 Application Layer Protocol: File Transfer Protocols

title: "T1071.002 Application Layer Protocol: File Transfer Protocols"
id: df93019b-e85e-4987-b156-86ea207e63b7
description: 'Detection of File Transfer Protocol-Based C2 (FTP, FTPS, SMB, TFTP). (Retargeted to the process_creation ESXi telemetry that actually captures this techniques behavior; see logsource below.) Tune using: TransferTargetDomainOrIP, SourceDirectoryFilter.'
references:
  - https://attack.mitre.org/techniques/T1071/002
author: Shahrukh Khan
date: 2026-05-01
license: MIT
tags:
  - attack.command-and-control
  - attack.t1071.002

logsource:
  category: process_creation
  product: esxi
  service: shell

detection:
  selection:
    CommandLine|contains:
      - 'ftp '
      - 'tftp '
      - 'curl ftp://'

  condition: selection

falsepositives:
  - Legitimate firmware or VIB retrieval scripts that pull from internal FTP or TFTP repositories will also match.

level: medium

Related sub-techniques

Explore