HTTP 200 OK
Allow: GET, PUT, PATCH, DELETE, HEAD, OPTIONS
Content-Type: application/json
Vary: Accept
{
"id": 353,
"key": "c2-via-ftps",
"unprotect_id": "U0910",
"name": "C2 via FTP(S)",
"description": "C2 via FTP is a technique that utilizes the File Transfer Protocol (FTP) to establish command and control communication between an attacker and victim systems. It involves sending commands and receiving responses within FTP sessions, effectively using FTP as a conduit for covert communication.\r\n\r\nTo implement C2 via FTP, an attacker needs control over an FTP server, and must establish a connection to a compromised system that has access to an external network. The victim’s system must be capable of initiating FTP sessions with the attacker's server. Additionally, the attacker could employ various means of obfuscation to make the traffic appear innocuous and blend in with legitimate FTP traffic.\r\n\r\nC2 via FTP can serve diverse objectives, such as remotely executing commands, managing malware, or orchestrating multistage attacks. Detecting C2 via FTP can be challenging, as FTP is a widely-used protocol for legitimate file transfers, and the malicious traffic may not raise alarms in a network’s security monitoring systems. Moreover, if FTPS (FTP Secure) is used, the data is encrypted, adding an additional layer of complexity to detection.",
"resources": "https://github.com/DarkCoderSc/SharpFtpC2",
"creation_date": "2023-06-12T08:10:43.726000Z",
"tags": "C2, FTP, FTPS, File",
"modification_date": "2023-10-04T10:44:31.505000Z",
"category": [
9
],
"rules": [],
"attachments": [],
"featured_api": [
23,
25,
290,
380,
381,
383,
450,
452,
459,
485,
603,
604,
605,
606,
607,
608,
609,
610,
611,
612,
613,
614,
615,
616,
617,
618,
619
],
"contributors": [
4
]
}
