6.21. FTP/FTP-DATA Keywords¶
6.21.1. ftpdata_command¶
Filter ftp-data channel based on command used on the FTP command channel. Currently supported commands are RETR (get on a file) and STOR (put on a file).
Syntax:
ftpdata_command:(retr|stor)
Examples:
ftpdata_command:retr
ftpdata_command:stor
Signature example:
alert ftp-data any any -> any any (msg:"FTP store password"; filestore; filename:"password"; ftpdata_command:stor; sid:3; rev:1;)