LOLBAS ftp.exe -s: abuse to execute local script from LNK

Emiliano Mema@Nosalva

•updated Aug 28, 2026•0•0•6

Detects the abuse of the Windows ftp.exe utility to execute a local script file provided via the -s flag. Adversaries may leverage this behavior, often triggered by malicious LNK files, to proxy the execution of commands or scripts.