FTP STOR Command Large Data Transfer Exfiltration

Ankit Mehta@Secvyn

•updated Jun 30, 2026•0•0•2

This rule monitors for FTP 'STOR' commands followed by large data transfers (exceeding 64KB) initiated from internal hosts to external destinations. This pattern is often indicative of data exfiltration using the File Transfer Protocol (FTP).