FTP Data Exfiltration via STOR Command to External Host

Ankit Mehta@Secvyn

•updated Jun 30, 2026•0•0•3

Detects repeated use of the FTP 'STOR' command to transmit data to an external host within a short timeframe. The STOR command is used in the File Transfer Protocol (FTP) to upload a file to the server. An unusual frequency of this command toward external destinations may indicate data exfiltration.