.. / Ftp.exe
Star

A binary designed for connecting to FTP servers


Paths:


Resources:
https://twitter.com/0xAmit/status/1070063130636640256
https://medium.com/@0xamit/lets-talk-about-security-research-discoveries-and-proper-discussion-etiquette-on-twitter-10f9be6d1939
https://ss64.com/nt/ftp.html

Acknowledgement:
Casey Smith - @subtee
BennyHusted -
Amit Serper - @0xAmit


Detection:
cmd /c as child process of ftp.exe



Execute

Executes the commands you put inside the text file.
echo !calc.exe > ftpcommands.txt && ftp -s:ftpcommands.txt
Usecase:Spawn new process using ftp.exe. Ftp.exe runs cmd /C YourCommand
Privileges required:User
OS:Windows 7, Windows 8, Windows 8.1, Windows 10
Mitre:T1218