From 2d39da5883efc39f2c5216275524355b11593416 Mon Sep 17 00:00:00 2001
From: Martin Rothe <martin@rothe.uk>
Date: Mon, 16 Oct 2023 17:30:31 +0100
Subject: [PATCH] Add FTP monitoring

---
 n4sysmon-dec2020.xml   | 1 +
 n4sysmon-endpoints.xml | 1 +
 2 files changed, 2 insertions(+)

diff --git a/n4sysmon-dec2020.xml b/n4sysmon-dec2020.xml
index ea8546d..24ee659 100644
--- a/n4sysmon-dec2020.xml
+++ b/n4sysmon-dec2020.xml
@@ -377,6 +377,7 @@
 				<Image condition="image">psinfo.exe</Image>
 				<Image name="technique_id=T1218,technique_name=Signed Binary Proxy Execution" condition="image">Mavinject.exe</Image>
 				<!--Ports: Suspicious-->
+				<DestinationPort name="FTP" condition="is">21</DestinationPort>				<!--FTP - File Transfer-->
 				<DestinationPort name="SSH" condition="is">22</DestinationPort>				<!--SSH protocol, monitor admin connections-->
 				<DestinationPort name="Telnet" condition="is">23</DestinationPort>				<!--Telnet protocol, monitor admin connections, insecure-->
 				<DestinationPort name="SMTP" condition="is">25</DestinationPort>				<!--SMTP mail protocol port, insecure, used by threats-->
diff --git a/n4sysmon-endpoints.xml b/n4sysmon-endpoints.xml
index ea8546d..24ee659 100644
--- a/n4sysmon-endpoints.xml
+++ b/n4sysmon-endpoints.xml
@@ -377,6 +377,7 @@
 				<Image condition="image">psinfo.exe</Image>
 				<Image name="technique_id=T1218,technique_name=Signed Binary Proxy Execution" condition="image">Mavinject.exe</Image>
 				<!--Ports: Suspicious-->
+				<DestinationPort name="FTP" condition="is">21</DestinationPort>				<!--FTP - File Transfer-->
 				<DestinationPort name="SSH" condition="is">22</DestinationPort>				<!--SSH protocol, monitor admin connections-->
 				<DestinationPort name="Telnet" condition="is">23</DestinationPort>				<!--Telnet protocol, monitor admin connections, insecure-->
 				<DestinationPort name="SMTP" condition="is">25</DestinationPort>				<!--SMTP mail protocol port, insecure, used by threats-->