FTP Connection Using an Anonymous Login or Default Credentials

Cortex XDR Analytics Alert Reference by data source

Product
Cortex XDR
Last date published
2024-12-03
Category
Analytics Alert Reference
Order
data source

Synopsis

Activation Period

14 Days

Training Period

30 Days

Test Period

N/A (single event)

Deduplication Period

1 Day

Required Data

  • Requires:
    • Palo Alto Networks Platform Logs

Detection Modules

Detector Tags

ATT&CK Tactic

ATT&CK Technique

Severity

Low

Description

An FTP connection using an anonymous login was detected.

Attacker's Goals

Attackers may seek access to FTP accounts and use them to exfiltrate data, stage attack tools, or create command and control channels through trusted services.

Investigative actions

  • Examine the legitimacy of the application that produced this FTP.
  • Examine the parent process of this application.
  • Verify that the connection attempts were not performed from an illegitimate source.