Techniques › T1071 › T1071.002
T1071.002 File Transfer Protocols
command and control — ESXi, Linux, macOS, Network Devices, Windows · attack.mitre.org · JSON
1
MITRE detection strategy
5
analytics
0
Sigma rules tagged attack.t1071.002
1
KEV CVEs mapped here
<p>Adversaries may communicate using application layer protocols associated with transferring files to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.</p><p>Protocols such as SMB, FTP, FTPS, and TFTP that transfer files may be very common in environments. Packets produced from these protocols may have many fields and headers in which data can be concealed. Data could also be concealed within the transferred files. An adversary may abuse these protocols to communicate with systems under their control within a victim network while also mimicking normal, expected traffic.</p>
KEV CVEs mapped to this technique · CTID Mappings Explorer
| CVE | Vendor / product | Mapping type | State | Added |
|---|---|---|---|---|
| CVE-2023-40044 | Progress WS_FTP Server | primary impact | Mapped | 2023-10-05 |
Detection strategy · ATT&CK Enterprise v19.2
- DET0416 Detection of File Transfer Protocol-Based C2 (FTP, FTPS, SMB, TFTP) v1.0
AN1169 WindowsDetects FTP, SMB, or TFTP traffic initiated by suspicious processes like PowerShell, cmd.exe, or rundll32.exe—especially with large outbound file transfers or unbalanced traffic volume.Tunable:
ProcessImageFilterDataFlowDirectionThresholdFilenamePatternAN1170 LinuxDetects usage of FTP, SCP, or TFTP by non-interactive shells or automation scripts transferring large data volumes to untrusted IPs.Tunable:TransferSizeThresholdCommandLinePatternMatchAN1171 macOSDetects Automator, AppleScript, or Terminal executing curl, lftp, or TFTP for binary transfer to untrusted IPs or unusual ports.Tunable:FilePathAccessedNetworkPortAnomalyAN1172 ESXiDetects file movement or outbound TFTP/FTP transfers from ESXi host initiated via shell commands or injected scripts, particularly from scratch partitions or /tmp.Tunable:TransferTargetDomainOrIPSourceDirectoryFilterAN1173 Network DevicesDetects internal hosts generating large outbound FTP/TFTP/SMB sessions to external IPs, or file transfers using non-standard ports and application mismatches (e.g., FTP over port 80).Tunable:AppLayerProtocolMatchOutboundDataRateThreshold
Sigma rules · SigmaHQ da9bb07d64, tag attack.t1071.002
No Sigma rule carries this tag. MITRE publishes a detection strategy above, so the behaviour is specified; what is missing is public detection content. 1 actively exploited CVE maps here.
Rules tagged at the parent level (attack.t1071) 7
These target the parent technique, not this sub-technique specifically. Listed for completeness, not counted as coverage.
Author: Aleksey Potapov, oscd.community
· 2019-10-22 (modified 2023-02-13) · logsource: product=windows category=process_creation · 03552375-cc2c-4883-bbe4-7958d5a980be
Detects SILENTTRINITY stager use via PE metadata
Author: @kostastsale
· 2024-08-16 · logsource: product=windows category=process_creation · 0ea52357-cd59-4340-9981-c46c7e900428
Detects the execution of rundll32.exe with the oledb32.dll library to open a UDL file.
Threat actors can abuse this technique as a phishing vector to capture authentication credentials or other sensitive data.
Author: Tim Burrell
· 2020-02-07 (modified 2023-01-02) · logsource: product=windows service=dns-server-analytic · 3db10f25-2527-4b79-8d4b-471eb900ee29
Detects artefacts associated with activity group GALLIUM - Microsoft Threat Intelligence Center indicators released in December 2019.
Author: Tim Burrell
· 2020-02-07 (modified 2024-11-23) · logsource: product=windows category=process_creation · 440a56bf-7873-4439-940a-1c8a671073c2
Detects artifacts associated with GALLIUM cyber espionage group as reported by Microsoft Threat Intelligence Center in the December 2019 report.
Author: Daniel Koifman (KoifSec)
· 2025-11-29 · logsource: product=windows category=process_creation · 5bac7a56-da88-4c27-922e-c81e113b20cb
Detects GitHub self-hosted runners executing workflows on local infrastructure that could be abused for persistence and code execution.
Shai-Hulud is an npm supply chain worm targeting CI/CD environments.
It installs runners on compromised systems to maintain access after credential theft, leveraging their access to secrets and internal networks.
Author: Aleksey Potapov, oscd.community
· 2019-10-22 (modified 2023-02-17) · logsource: product=windows category=image_load · 75c505b1-711d-4f68-a357-8c3fe37dbf2d
Detects SILENTTRINITY stager dll loading activity
Author: Sohan G (D4rkCiph3r)
· 2023-02-18 · logsource: product=macos category=process_creation · e0cfaecd-602d-41af-988d-f6ccebb2af26
Detects the execution of suspicious child processes from macOS installer package parent process. This includes osascript, JXA, curl and wget amongst other interpreters