New FTP Server

Synopsis

Field	Value
Activation Period	14 Days
Training Period	30 Days
Test Period	N/A (single event)
Deduplication Period	1 Day
Required Data	Requires one of the following data sources: Palo Alto Networks Firewall traffic Logs OR XDR Agent OR Third-Party Firewalls
ATT&CK Tactic	Initial Access (TA0001), Collection (TA0009)
ATT&CK Technique	Data from Information Repositories (T1213), Valid Accounts (T1078)
Severity	Low

Description

A new FTP server has been detected.

Attacker's Goals

• Attackers may seek to access FTP resources to exfiltrate data, stage attack tools or create a command and control channel through a trusted service.

Investigative actions

• Verify that the new service is legitimate.* Examine the legitimacy of the application that produced this uncommon FTP.
• Examine the parent process of this application.

Variations

New FTP Server Accessed Via a Port Scan

Synopsis

Field	Value
ATT&CK Tactic	Initial Access (TA0001), Collection (TA0009)
ATT&CK Technique	Data from Information Repositories (T1213), Valid Accounts (T1078)
Severity	Informational

Description

A new FTP server has been detected.

Attacker's Goals

• Attackers may seek to access FTP resources to exfiltrate data, stage attack tools or create a command and control channel through a trusted service.

Investigative actions

• Verify that the new service is legitimate.* Examine the legitimacy of the application that produced this uncommon FTP.
• Examine the parent process of this application.

New FTP Server from an external source

Synopsis

Field	Value
ATT&CK Tactic	Initial Access (TA0001), Collection (TA0009)
ATT&CK Technique	Data from Information Repositories (T1213), Valid Accounts (T1078)
Severity	Low

Description

A new FTP server has been detected.

Attacker's Goals

• Attackers may seek to access FTP resources to exfiltrate data, stage attack tools or create a command and control channel through a trusted service.

Investigative actions

• Verify that the new service is legitimate.* Examine the legitimacy of the application that produced this uncommon FTP.
• Examine the parent process of this application.