Analytics BIOC
Low
✕
FTP Connection Using an Anonymous Login or Default Credentials
An FTP connection using an anonymous login was detected.
- Module:
- Platform Analytics
- Data source:
- Palo Alto Networks Firewall EAL Logs
ATT&CK tactics: Initial Access (TA0001) Credential Access (TA0006)
ATT&CK techniques: Brute Force (T1110) Valid Accounts (T1078)
Attacker's goals:
Attackers may seek access to FTP accounts and use them to exfiltrate data, stage attack tools, or create command and control channels through trusted services.
Investigative actions:
Examine the legitimacy of the application that produced this FTP. Examine the parent process of this application. Verify that the connection attempts were not performed from an illegitimate source.
- Test period:
- N/A (single event)
- Deduplication:
- 1 Day