Outbound FTP STOR Command Data Exfiltration to External Server

Ankit Mehta@Secvyn

•updated Jun 30, 2026•0•0•2

This rule detects outbound FTP traffic containing the 'STOR' command, which is used in the FTP protocol to upload files to a remote server. This behavior is a common indicator of unauthorized data exfiltration.