Detecting FTP and SFTP Exfiltration

File-transfer protocols remain a quiet exfiltration route because they are simple, scriptable and often open on the egress firewall. The key is scoping: define which systems are permitted to send files out over ports 21, 22 and 990, and treat everything else as an alert. That inverts a noisy hunt into a short exception list.

Signals at a Glance

Network-Level Detection

Maintain an explicit list of hosts that may send files out, usually a managed-file-transfer gateway and a handful of integration servers. Alert on any other source:

// Sentinel (KQL) - outbound FTP/SFTP/FTPS from non-allowlisted sources
// tune/validate: populate the allowlist from your MFT inventory
let allowed = dynamic(["10.20.5.10","10.20.5.11"]);
CommonSecurityLog
| where TimeGenerated > ago(1d)
| where DeviceAction == "allow" and DestinationPort in (21, 22, 990)
| where ipv4_is_private(DestinationIP) == false
| where SourceIP !in (allowed)
| summarize sessions = count(), bytesOut = sum(SentBytes), dests = dcount(DestinationIP)
    by SourceIP, DestinationPort
| where bytesOut > 10000000 or sessions > 20
| order by bytesOut desc

Plain FTP is easier to inspect than SFTP because Zeek parses its command channel. Uploads are STOR commands, and the reply code tells you whether they succeeded:

# Zeek ftp.log fields: ts uid id.orig_h id.resp_h user command arg mime_type file_size reply_code
# Zeek - extract external uploads from ftp.log (zeek-cut)
cat ftp.log | zeek-cut ts id.orig_h id.resp_h user command arg file_size reply_code \
  | awk '$5=="STOR" || $5=="APPE" {print}' \
  | awk '$3 !~ /^(10[.]|192[.]168[.]|172[.](1[6-9]|2[0-9]|3[01])[.])/'
# tune/validate: SFTP rides SSH and is opaque; use conn.log byte counts on port 22 instead

Endpoint Command Lines

• WinSCP with /script= or /command, or psftp -b with a batch file, indicates unattended transfer.
• ftp.exe -s:file.txt is a classic scripted pattern; the script file often holds the credentials in clear text.
• curl -T or curl --upload-file to an ftp:// URL, and PowerShell using System.Net.WebClient.UploadFile or FtpWebRequest.
• Alert harder when the sending process is a scripting engine or a user-writable binary, and when the destination is a residential or hosting-provider address.