TGI HUNT Possible FTP Exfil Flowbit Set

SID: 2610612Rev: 1Enabled18 views
Filehunting.rules
CreatedMarch 19, 2025
UpdatedMarch 19, 2025
Classificationbad-unknown
alert ftp any any -> any any (msg:"TGI HUNT Possible FTP Exfil Flowbit Set"; flow:established,to_server; content:"/incoming/"; flowbits:set,ftp_exfil; flowbits:noalert; classtype:bad-unknown; sid:2610612; rev:1;)

Comments (0)

Please sign in to leave a comment.
Sign in

No comments yet. Be the first to comment!