Abnormal FTP Command Sequence - No Filename Parameter

Ankit Mehta@Secvyn

•updated Jun 24, 2026•1•0•4

Detects unusual FTP command sequences where common file listing commands (LIST, NLST, MLSD) are used without specifying a filename parameter, and the RemoteUrl length is unusually short, potentially indicating reconnaissance or an attempt to exploit a vulnerability like Squidbleed. The rule specifically excludes common file extensions to reduce false positives.