FTP Transfer Mode Switching (ASCII/Binary)

Ankit Mehta@Secvyn

•updated Jun 24, 2026•1•0•5

Detects instances of FTP transfer mode switching (ASCII/Binary) by monitoring network events for FTP traffic on port 21 and specific commands like 'TYPE A' or 'TYPE I' in the RemoteUrl. This behavior can be indicative of data transfer activities, potentially related to vulnerabilities or malicious data exfiltration.