MirrorFaceG1054 ↗
Has used the the PuTTY suite Secure Copy Protocol (SCP) client for file transfer.1
tfMITRE ATT&CK sub-technique
File Transfer Protocols T1071.002
sub-technique of T1071 Application Layer Protocol
- Tactic
- Command and Control
- Platforms
- ESXi, Linux, macOS, Network Devices, Windows
- Version
- 1.4
- Created
- 15 March 2020
- Last modified
- 12 May 2026
- Contributor
- Don Le, Stifel Financial
Adversaries may communicate using application layer protocols associated with transferring files to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
ReconResource DevInitial AccessExecutionPersistencePriv EscStealthDef ImpairmentCred AccessDiscoveryLateral MoveCollectionC2ExfiltrationImpact
5
Threat groups73rd pct
Threat groups73rd percentile · 73% of ATT&CK techniques have this many threat groups attributed or fewer.2
CampaignsTop 17%
Campaigns83rd percentile · 83% of ATT&CK techniques have this many campaigns recorded or fewer.20
Tools & malwareTop 17%
Tools & malware83rd percentile · 83% of ATT&CK techniques have this many tools implementing them or fewer.1
Detection rules42nd pct
Detection rules42nd percentile · 58% of ATT&CK techniques have more detection rules written.File Transfer Protocols MITRE reference T1071.002
73rd pctamong all ATT&CK techniques for number of groups
5 groups have been recorded using this technique. Newest first; each entry carries MITRE’s procedure text and a link to the group’s full record. Click a name to filter the rules below.
APT41G0096 ↗
KimsukyG0094 ↗
Has used FTP to download additional malware to the target machine.1
SilverTerrierG0083 ↗
Uses FTP for C2 communications.1
DragonflyG0035 ↗
Has used SMB for C2.1
All 5 groups for this technique
2 campaigns have been recorded using this technique. Listed newest first; dates are year-granularity and attribution is MITRE’s.
Quad7 ActivityC0055 ↗
Has used a File Transfer Protocol (FTP) server to download malicious binaries.1
Operation HoneybeeC0006 ↗
During Operation Honeybee, the threat actors had the ability to use FTP for C2.1
All 2 campaigns for this technique
20 software entries are documented implementing this technique. MITRE files each as a tool or as malware; newest first, then by how many groups carry them.
QilinS1242 ↗
Can use WinSCP for the secure file transfer of the Linux ransomware binary to a targeted system.1
HavocS1229 ↗
PUBLOADS1228 ↗
Has used curl for data exfiltration over FTP.1
SharpDiscoS1089 ↗
Has the ability to transfer data between SMB shares.1
DiscoS1088 ↗
Can use SMB to transfer files.1
BADHATCHS1081 ↗
Can emulate an FTP server to connect to actor-controlled C2 servers.1
All 20 software entries for this technique · 6 newest in this preview
Offense vs defense T1071.002
Is defensive coverage keeping up with adversary use? Eight counts, each ranked against all 697 ATT&CK techniques. Attack sits left, defense right, so a shape leaning left means adversaries are better documented here than defenders are equipped. Hover any spoke for its percentile and the share of techniques that have more. The timeline below shows when each side arrived.
How it got here
Range
Adversary activity (campaign spans) over cumulative rule output. Each source is plotted independently from zero, so neither line includes the other. Campaign dates are year-granularity.
Campaigns · 2Sigma rules (cumulative) · 0Splunk ESCU (cumulative) · 1
first rule: 2020 Q2 · 2 of 2 campaigns plottedFile Transfer Protocols detection strategy DET0416
MITRE names one behaviour worth catching for this technique and breaks it into 5 analytics, one per platform. Each carries the log sources it needs and the fields you tune per environment.
Detection of File Transfer Protocol-Based C2 (FTP, FTPS, SMB, TFTP)
5 platforms
AN1169 · Windows
Detects FTP, SMB, or TFTP traffic initiated by suspicious processes like PowerShell, cmd.exe, or rundll32.exe—especially with large outbound file transfers or unbalanced traffic volume.
Log sources
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
| Data component | Name | Channel |
|---|---|---|
| Process CreationDC0032 | WinEventLog:Sysmon | EventCode=1 |
| Network Connection CreationDC0082 | WinEventLog:Sysmon | EventCode=3, 22 |
| Network Traffic ContentDC0085 | NSM:Flow | ftp.log, smb_files.log |
Tunable fields
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
| Field | What you tune |
|---|---|
| ProcessImageFilter | Limit to non-standard FTP clients or suspicious binaries (e.g., cmd, mshta) |
| DataFlowDirectionThreshold | Ratio of outbound:inbound bytes; e.g., >90% outbound |
| FilenamePattern | Suspicious file extensions or naming (e.g., .zip, .rar, random hash names) |
AN1170 · Linux
Detects usage of FTP, SCP, or TFTP by non-interactive shells or automation scripts transferring large data volumes to untrusted IPs.
Log sources
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
| Data component | Name | Channel |
|---|---|---|
| Process CreationDC0032 | auditd:SYSCALL | execve |
| Network Traffic ContentDC0085 | NSM:Flow | ftp.log, conn.log |
Tunable fields
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
| Field | What you tune |
|---|---|
| TransferSizeThreshold | Bytes sent in FTP upload or SCP push |
| CommandLinePatternMatch | e.g., scp -r /var/log/* or ftp upload scripts |
AN1171 · macOS
Detects Automator, AppleScript, or Terminal executing curl, lftp, or TFTP for binary transfer to untrusted IPs or unusual ports.
Log sources
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
| Data component | Name | Channel |
|---|---|---|
| Command ExecutionDC0064 | macos:unifiedlog | log stream --predicate |
| Network Traffic FlowDC0078 | macos:osquery | socket_events |
Tunable fields
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
| Field | What you tune |
|---|---|
| FilePathAccessed | e.g., ~/Documents, ~/Library/logs/ |
| NetworkPortAnomaly | Non-standard FTP/TFTP ports used (e.g., FTP over 443) |
AN1172 · ESXi
Detects file movement or outbound TFTP/FTP transfers from ESXi host initiated via shell commands or injected scripts, particularly from scratch partitions or /tmp.
Log sources
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
| Data component | Name | Channel |
|---|---|---|
| Command ExecutionDC0064 | esxi:shell | /root/.ash_history |
| Network Traffic ContentDC0085 | NSM:Flow | mirror/SPAN port |
Tunable fields
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
| Field | What you tune |
|---|---|
| TransferTargetDomainOrIP | Public IPs or domains not belonging to known ESXi mgmt infra |
| SourceDirectoryFilter | Monitor transfers from /tmp/, /etc/, /vmfs/volumes/ |
AN1173 · Network Devices
Detects internal hosts generating large outbound FTP/TFTP/SMB sessions to external IPs, or file transfers using non-standard ports and application mismatches (e.g., FTP over port 80).
Log sources
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
| Data component | Name | Channel |
|---|---|---|
| Network Traffic ContentDC0085 | NSM:Flow | ftp.log, conn.log, smb_files.log |
Tunable fields
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
| Field | What you tune |
|---|---|
| AppLayerProtocolMatch | e.g., FTP/SMB observed over uncommon ports |
| OutboundDataRateThreshold | Bytes transferred outside trusted subnets >100MB |
Filter outbound FTP/SFTP traffic from sensitive systems, allowing file transfers only to trusted internal or known IP addresses. This measure can prevent attackers from transferring data or payloads via FTP/SFTP channels to or from unauthorized external systems.
Network intrusion detection and prevention systems that use network signatures to identify traffic for specific adversary malware can be used to mitigate activity at the network level.