FTP Data Exfiltration - Outbound STOR Command to External Server

Ankit Mehta@Secvyn

•updated Jun 30, 2026•0•0•3

Detects outbound FTP STOR (Store) commands directed to external networks. This indicates that a host inside the local network is attempting to upload data to an external server. The rule uses a threshold to filter out isolated commands, triggering when 3 or more STOR commands are detected within 120 seconds, which is characteristic of data exfiltration or staging behavior.