Exfiltration Over FTP and SFTP

Overview

Exfiltration over FTP (File Transfer Protocol) and SFTP (Secure File Transfer Protocol) is a technique used by adversaries to transfer stolen data from a compromised environment to an external location. This method leverages standard file transfer protocols to move data stealthily, often blending with legitimate network traffic to evade detection. It is commonly employed during the exfiltration phase of the attack lifecycle to extract valuable information.

Attack Objective

• Primary goal: Data theft through unauthorized transfer of sensitive information
• Attack lifecycle stage: Exfiltration
• Advances attacker position by enabling the removal of valuable data for further exploitation, monetization, or intelligence gathering

How the Technique Works

Adversaries establish an FTP or SFTP connection from the compromised system to an external server under their control. Using these protocols, they upload files containing sensitive data. FTP transmits data in plaintext, while SFTP operates over SSH, providing encryption. Attackers may use legitimate credentials, stolen keys, or misconfigured services to authenticate and transfer data, often automating the process to minimize manual interaction and detection.

Common Methods & Variations

• Use of standard FTP servers or cloud-based FTP/SFTP services for data transfer
• Deployment in on-premises networks or cloud environments where FTP/SFTP access is permitted
• Utilization of living-off-the-land binaries (e.g., command-line FTP clients, OpenSSH tools) versus custom or third-party exfiltration tools

Indicators of Compromise (IOCs)

• Unusual outbound FTP/SFTP connections, especially to unknown or suspicious IP addresses
• Authentication attempts using compromised or unexpected credentials
• Large or irregular file transfers detected in network logs
• Presence of FTP/SFTP client binaries in uncommon locations on endpoints

Detection Strategies

• Monitoring network traffic for anomalous FTP/SFTP sessions, including unusual destinations and transfer volumes
• Analyzing authentication logs for irregular login patterns or failed attempts related to FTP/SFTP services
• Employing behavioral detection to identify atypical file transfer activities and timing
• Correlating endpoint process execution with network connections to identify unauthorized data transfers

Mitigation & Prevention

• Restrict and monitor FTP/SFTP access through network segmentation and firewall rules
• Enforce strong authentication mechanisms, including multi-factor authentication and key management for SFTP
• Disable or remove unnecessary FTP/SFTP services and clients from endpoints
• Implement data loss prevention (DLP) solutions to detect and block unauthorized data transfers
• Regularly audit and update access controls and permissions related to file transfer services

Response Considerations

• Immediately isolate affected systems to prevent further data exfiltration
• Collect and analyze network and authentication logs to identify the scope and timeline of data transfers
• Identify compromised credentials or keys used for FTP/SFTP access and revoke or reset them
• Conduct forensic analysis on endpoints to determine the extent of compromise and presence of additional tools
• Strengthen controls and monitor for reoccurrence following remediation

Related Techniques

• Data Staged: Preparing data for exfiltration prior to transfer
• Exfiltration Over Alternative Protocols: Using other protocols such as HTTP/S, DNS, or cloud storage for data exfiltration
• Credential Access: Obtaining credentials to authenticate to FTP/SFTP servers
• Command and Control: Maintaining communication channels that may facilitate exfiltration

Mapping & References

• MITRE ATT&CK Tactic: Exfiltration
• MITRE ATT&CK Techniques: T1041 (Exfiltration Over C2 Channel), T1048 (Exfiltration Over Alternative Protocol)
• Public research and advisories on network-based data exfiltration methods
• Industry incident reports highlighting FTP/SFTP exfiltration cases