Cleartext FTP upload of an archive or database dump

Siemphony@siemphonymediumT1048.003unverified

Matches the FTP store commands — STOR, STOU and APPE — that push a file from the monitored network out to a server, restricted to arguments naming an archive, backup or database-export extension, which is the staged-collection shape MITRE's AN0423 describes moving over an unencrypted protocol. Zeek's ftp.log is chosen over the endpoint sources in the brief because it records the direction and the file name of the transfer, which the Windows process and connection events do not; the corpus already covers the endpoint side of this family in T1048 (port-based) and T1048.002 (encrypted egress). MITRE's DataTransferSizeThreshold knob is the analytic's real discriminator and Sigma has no numeric comparison, so this rule fires on one upload rather than on volume. FTPS and SFTP sessions never produce these command records at all, so absence of matches is not evidence that nothing left the estate. UNVERIFIED AS AUTHORED — derived from MITRE ATT&CK DET0149, not hand-written and not tested by its author. Any lab result is on this rule's own page.Full description

The 3 SIEM queries below are previews produced by Siemphony’s own translator, not pySigma, and none has been executed against a real backend — review before you deploy.

detection.yml

Splunk · SPL

Run this as a search.

index=* ((command="STOR" OR command="STOU" OR command="APPE") AND (arg="*.zip" OR arg="*.rar" OR arg="*.7z" OR arg="*.tar" OR arg="*.gz" OR arg="*.tgz" OR arg="*.cab" OR arg="*.bak" OR arg="*.sql" OR arg="*.dmp" OR arg="*.pst" OR arg="*.csv"))

Elastic · ES|QL

Run this as a search.

FROM logs-*| WHERE ((TO_LOWER(command) == "stor" OR TO_LOWER(command) == "stou" OR TO_LOWER(command) == "appe") AND (TO_LOWER(arg) LIKE "*.zip" OR TO_LOWER(arg) LIKE "*.rar" OR TO_LOWER(arg) LIKE "*.7z" OR TO_LOWER(arg) LIKE "*.tar" OR TO_LOWER(arg) LIKE "*.gz" OR TO_LOWER(arg) LIKE "*.tgz" OR TO_LOWER(arg) LIKE "*.cab" OR TO_LOWER(arg) LIKE "*.bak" OR TO_LOWER(arg) LIKE "*.sql" OR TO_LOWER(arg) LIKE "*.dmp" OR TO_LOWER(arg) LIKE "*.pst" OR TO_LOWER(arg) LIKE "*.csv"))

Wazuh · XML rule

Deploy to your manager — this is a rule, not a search.

<group name="sigma,zeek,">  <!-- Rule ids must be unique on your manager; 100000+ is the user range. -->  <rule id="100000" level="7">    <!-- Set <if_sid> to the decoder/base rule for zeek so this only evaluates relevant events. -->    <field name="command" type="pcre2">(?i)(^STOR$|^STOU$|^APPE$)</field>    <field name="arg" type="pcre2">(?i)(\.zip$|\.rar$|\.7z$|\.tar$|\.gz$|\.tgz$|\.cab$|\.bak$|\.sql$|\.dmp$|\.pst$|\.csv$)</field>    <description>Cleartext FTP upload of an archive or database dump</description>    <mitre>      <id>T1048.003</id>    </mitre>  </rule></group>

Sentinel · KQL

Run this as a search.

Sentinel cannot express this construct. No Sentinel table is modelled for this logsource ({"product":"zeek","service":"ftp"}), so there is nothing honest to query. Pick a logsource this translator maps, or write the KQL by hand. The Sigma source is on the first tab, unchanged.

At a glance

Logsource: ftp / zeek
Level: medium
Category: data_staging_exfil
Sigma status: experimental
Backends: 3 of 4 rendered
Updated: 30 Aug 2026
Rule ID: 662112ba-1b10-4195-9792-a2a1046d9d58

ATT&CKT1048.003

T1048.003Exfiltration Over Unencrypted Non-C2 Protocol

ATT&CK® is a registered trademark of The MITRE Corporation. These mappings are the rule author’s, and are neither reviewed nor endorsed by MITRE.

Lessondata staging exfil

data staging exfilAI draft — unreviewed

01 · What this rule detects

A single Zeek ftp.log record where the FTP command is a store verb and the argument names an archive, backup or database-export file. AN0423 describes "data access or staging events followed by outbound data flows using unencrypted protocols... initiated by unexpected processes or to rare destinations" — three things joined in sequence. Sigma has no numeric comparison, so MITRE's DataTransferSizeThreshold knob, which is the analytic's real discriminator and the thing separating a transfer from exfiltration, cannot be expressed. No time window either, so the staging leg is gone. What remains is one upload of one file.

02 · Telemetry you need

product: zeek / service: ftp, verbatim from AN0423's NSM:Flow::ftp.log entry. command and arg are genuine Zeek columns, and STOR/STOU/APPE are in Zeek's default FTP::logged_commands, so the records exist.
The network source was chosen over the endpoint ones for a good reason: Sysmon EventID 3 gives an IP and a port and says nothing about what moved or which way. Zeek's ftp.log knows the filename and the direction. But FTPS and SFTP produce no command records at all — SFTP is an SSH subsystem and never speaks FTP verbs — so silence is not evidence that nothing left. Sentinel refuses the Zeek logsource; the other three render.

03 · How the logic works

command takes no modifier — exact matches, which the Wazuh render shows as ^STOR$ anchors. That is right: FTP verbs are a closed vocabulary. All three are store verbs; RETR (retrieve) is deliberately absent, which is the rule's only gesture at direction. MITRE named the UnencryptedProtocolList knob and FTP is MITRE's example; the twelve extensions are the author's. Now the reviewer's central finding. The description justifies choosing ftp.log because it records the direction — and the detection never tests direction. There is no id.orig_h/id.resp_h condition and no local-network gate. A supplier, a branch office, an MFP or an internal user uploading a .zip into your own FTP server matches identically to data leaving the estate. Asserting an advantage and then not using it is worse than never claiming it, because a reader trusts the claim. Two more: - STOU is inert. RFC 959 defines STOU as "store unique" — the server picks the filename, and the command is conventionally sent with no argument. Zeek logs it with an empty or - arg, so STOU can never satisfy selection_payload and the AND drops it. One verb in three contributes nothing. - The extension list is the whole gate, and renaming defeats it. rename data.zip data.tmp before the STOR, or no extension at all — normal for a staged archive — and none of the twelve terms match. Zeek's ftp.log carries mime_type (from the data-channel file analyser) and file_size, both harder to dodge than a filename, and neither is used. Since the rule already concedes it cannot implement DataTransferSizeThreshold, mime_type was the obvious substitute it passed over. One coverage gap: AN0423 names FTP and HTTP, and the brief supplies zeek/http alongside zeek/ftp. Only FTP is covered. HTTP POST exfiltration is much the more common of the two in current intrusions.

04 · Common false positives

The four shipped false positives are one class seen from four angles: legitimate scheduled FTP pushes of archive files — partner and EDI transfers, backup jobs dropping .bak/.sql/.csv, appliance config exports, build tooling publishing to a legacy FTP host. Honest, but it means the rule has exactly one false-positive class and it is enormous.
The reviewer adds the one the block misses, and it follows from the missing direction test: inbound uploads to your own FTP or EDI server. Customers, branch sites, printers and appliances pushing files in. On any estate still running an FTP server, that is the highest-volume match.
Hence the calibration problem. level: medium is defensible only where plain FTP is not routine — precisely the estate where this rule has nothing to detect either. Anywhere FTP is in daily use, start at informational until the allowed triples are pinned.

05 · Detection maturity

tier_1: .** UNVERIFIED — derived from DET0149, never executed against a log line. The fields are real Zeek columns and the log source is the right choice; what nobody has checked is whether anything it returns is outbound.
tier_2: run read-only for a fortnight and split every hit by responder address into inbound and outbound. That one split removes the bulk of the volume and tells you whether the rule has a job at all; then pin the surviving triples.
tier_3: restores MITRE's chain — file access, staging, then the upload, inside a TimeWindow and weighed against a size threshold — needing a correlation engine plus a numeric comparison, and Sigma has neither.

Tuning & false positivesexperimental · 4 declared

experimental (current stage)
test
stable

Written and reasoned about, but not yet run against real telemetry. Expect to tune it before trusting it.

Tuning tips

Add the direction test first. Sigma has no CIDR operator, so this is a
Pin the allowed client, server and directory triples rather than shortening
Split STOU out. It can never pass the extension gate, but a bare STOU is
Add a `mime_type` alternative — application/zip, application/x-gzip,
Write the `zeek/http` companion.
Knobs with nothing to bind to: DataTransferSizeThreshold (no numeric

Declared by the author

Sanctioned partner and EDI transfers. Estates that still exchange files with suppliers over plain FTP will match on every scheduled push, and the archive extensions selected here are exactly what those jobs carry. This is MITRE's ProcessBaseline thinking applied at the network layer — pin the allowed client, server and directory triple rather than shortening the extension list.
Backup and reporting jobs writing .bak, .sql or .csv to an internal FTP drop, which is business-normal in older estates and indistinguishable from staged exfiltration on the command and file name alone.
Appliance and network-device configuration exports, which are still commonly shipped to an FTP or TFTP collector as an archive during maintenance windows.
Developer and build tooling publishing release artefacts to a legacy FTP-backed distribution host.

Noise checknot tested

No baseline event covers this rule’s log type (ftp / zeek), so the rule was never evaluated. This is missing data, not a clean result — nothing was checked either way.

Run live against 65 hand-written events of ordinary corporate activity — backup agents, software distribution, patching, helpdesk scripts, EDR. It says nothing about how often the rule would fire in production, which is the number that actually exhausts an analyst.

Verificationnone

Never run

The lab has not evaluated this composition. A run needs a dataset of its log type — a capture of the technique it claims, or the benign baseline — and not every rule has one. Some are also held back by the evaluator’s own safety limits.

Other compositions here have been run and some carry the badge — this one has not, so nothing about it has been shown either way. Read the rule and its noise check on their own terms; silence here is the absence of evidence, not evidence of a problem.

Test it yourselfin your browser

Runs here in your browser against public attack recordings. A preview — not the verification badge.

Recordings of T1048.003, evaluated against their — events.

Share this rule

/u/siemphony/662112ba-1b10-4195-9792-a2a1046d9d58

More from this repertoire

All compositions

Verdicts · reactions · comments

Community

Verdicts from engineers who actually deployed it, and the conversation around it.

Not yet reported on

Nobody has run this in a real environment and said what happened.

Verdicts from engineers who deployed it

0 cast

No verdicts reported yet. The first one is worth more than the tenth — say what you ran it against.

No comments yet. Someone who deploys this will have something to say about it.

Cleartext FTP upload of an archive or database dump

The detection

detection.yml

Splunk · SPL

Elastic · ES|QL

Wazuh · XML rule

Sentinel · KQL

Community

Verdicts from engineers who deployed it