Detecting and Mitigating File Transfer Protocol C2 (T1071.002)

File Transfer Protocols (MITRE ATT&CK T1071.002) is a Command and Control technique. MITRE lists ESXi, Linux, macOS, network devices and Windows as platforms.

Adversaries use protocols meant for moving files to blend in with normal traffic. Commands to the remote system, and often the results, are embedded in the protocol traffic between client and server.

How attackers use it

MITRE names SMB, FTP, FTPS and TFTP as common examples. Their packets have many fields and headers where data can be hidden, and data can also be concealed inside the transferred files. An adversary can abuse them to talk to systems under their control within a victim network while looking like expected traffic.

How to detect it

MITRE's detection strategy has five analytics:

• Windows: FTP, SMB or TFTP traffic started by suspicious processes such as PowerShell, cmd.exe or rundll32.exe, especially large outbound transfers or unbalanced traffic volume.
• Linux: FTP, SCP or TFTP use by non-interactive shells or automation scripts that move large volumes to untrusted IPs.
• macOS: Automator, AppleScript or Terminal running curl, lftp or TFTP for binary transfer to untrusted IPs or unusual ports.
• ESXi: file movement or outbound TFTP or FTP transfers started from shell commands or injected scripts, particularly from scratch partitions or /tmp.
• Network devices: internal hosts making large outbound FTP, TFTP or SMB sessions to external IPs, or file transfers on non-standard ports and application mismatches, such as FTP over port 80.

Useful data: flow records with byte counts, endpoint network telemetry that names the process, and file server logs. A good first rule is any internal host speaking SMB to an external address, since SMB should stay inside.

How to reduce the risk

MITRE lists two mitigations:

1. Filter network traffic. Filter outbound FTP and SFTP from sensitive systems, and allow transfers only to trusted internal or known IP addresses. This prevents attackers from moving data or payloads through those channels to or from unauthorized external systems.
2. Network intrusion prevention. Use signature-based systems to find and block traffic from specific adversary malware.

Check your own environment

# Linux: connections to common file transfer ports with owning process (read only)
sudo ss -tnp state established '( dport = :21 or dport = :69 or dport = :445 )'

Then check whether any server can reach external FTP, TFTP or SMB at all, and whether your firewall blocks port 445 at the edge.

Quick check

Sources

• MITRE ATT&CK T1071.002: File Transfer Protocols