A binary designed for connecting to FTP servers
echo !calc.exe > ftpcommands.txt && ftp -s:ftpcommands.txt
Executes the commands you put inside the text file.
Spawn new process using ftp.exe. Ftp.exe runs cmd /C YourCommand
C:\Windows\System32\ftp.exe, C:\Windows\SysWOW64\ftp.exe
Sigma: https://github.com/SigmaHQ/sigma/blob/c04bef2fbbe8beff6c7620d5d7ea6872dbe7acba/rules/windows/process_creation/proc_creation_win_lolbin_ftp.yml, IOC: cmd /c as child process of ftp.exe
Casey Smith (@subtee), BennyHusted, Amit Serper (@0xAmit)