Analytics BIOC Low
✕

New FTP Server

A new FTP server has been detected.

Module:
Platform Analytics
Data source:
Palo Alto Networks Firewall traffic Logs, XDR Agent, Third-Party Firewalls
ATT&CK tactics: Initial Access (TA0001) Collection (TA0009)
ATT&CK techniques: Data from Information Repositories (T1213) Valid Accounts (T1078)
Attacker's goals:

Attackers may seek to access FTP resources to exfiltrate data, stage attack tools or create a command and control channel through a trusted service.

Investigative actions:

Verify that the new service is legitimate.* Examine the legitimacy of the application that produced this uncommon FTP. Examine the parent process of this application.

Test period:
N/A (single event)
Deduplication:
1 Day
2 variations:
  • New FTP Server Accessed Via a Port Scan Informational (parent: Low)
  • New FTP Server from an external source Low