Renamed FTP.EXE Execution

Title: Renamed FTP.EXE Execution
Status: test
Description:Detects the execution of a renamed "ftp.exe" binary based on the PE metadata fields
References:
  -https://lolbas-project.github.io/lolbas/Binaries/Ftp/
Author: Victor Sergeev, oscd.community
Date: 2020-10-09
modified:2023-02-03
Tags:

• -'attack.execution'
• -'attack.stealth'
• -'attack.t1059'
• -'attack.t1202'

Logsource:

• category: process_creation
• product: windows

Detection:
  selection_original:
    OriginalFileName: 'ftp.exe'
  filter_img:
    Image|endswith: '\ftp.exe'
  condition:selection_original and not filter_img
Falsepositives:
  -Unknown
Level: medium