https://live.paloaltonetworks.com/t5/next-generation-firewall/ftp-evasion-detection-id-30401/m-p/1238597#M6314 <P>Could anyone help to explain what this threat is?</P> <P>FTP evasion detection (id:30401)<BR /><BR />I found this threat in the log, also checked the logs in FTP server, but don't get it.</P> <P>here is the log from the source IP of this threat in FTP server (Microsoft IIS FTP).</P> <PRE>2025-09-16 04:43:54 8.34.210.54 - 10.10.10.31 21 ControlChannelOpened - - 0 0 8bb7b510-d8db-4808-94f0-4177688239fa -<BR />2025-09-16 04:43:54 8.34.210.54 - 10.10.10.31 21 ControlChannelClosed - - 0 0 8bb7b510-d8db-4808-94f0-4177688239fa -<BR />2025-09-16 04:43:55 8.34.210.54 - 10.10.10.31 21 ControlChannelOpened - - 0 0 959e077c-bc84-48c0-bbc1-4ad7af838dc4 -<BR />2025-09-16 04:43:55 8.34.210.54 - 10.10.10.31 21 - - 451 87 0 959e077c-bc84-48c0-bbc1-4ad7af838dc4 -<BR />2025-09-16 04:43:55 8.34.210.54 - 10.10.10.31 21 - - 451 87 0 959e077c-bc84-48c0-bbc1-4ad7af838dc4 -<BR />2025-09-16 04:43:55 8.34.210.54 - 10.10.10.31 21 - - 451 87 0 959e077c-bc84-48c0-bbc1-4ad7af838dc4 -<BR />2025-09-16 04:43:55 8.34.210.54 - 10.10.10.31 21 + - 500 87 0 959e077c-bc84-48c0-bbc1-4ad7af838dc4 -<BR />2025-09-16 04:43:55 8.34.210.54 - 10.10.10.31 21 ControlChannelClosed - - 1292 0 959e077c-bc84-48c0-bbc1-4ad7af838dc4 -</PRE> <P>I can not find any info about this threat when I dig the internet.<BR />Thank you!&nbsp;</P> Wed, 24 Sep 2025 03:05:31 GMT YanQian 2025-09-24T03:05:31Z https://live.paloaltonetworks.com/t5/next-generation-firewall/ftp-evasion-detection-id-30401/m-p/1238597#M6314 <P>Could anyone help to explain what this threat is?</P> <P>FTP evasion detection (id:30401)<BR /><BR />I found this threat in the log, also checked the logs in FTP server, but don't get it.</P> <P>here is the log from the source IP of this threat in FTP server (Microsoft IIS FTP).</P> <PRE>2025-09-16 04:43:54 8.34.210.54 - 10.10.10.31 21 ControlChannelOpened - - 0 0 8bb7b510-d8db-4808-94f0-4177688239fa -<BR />2025-09-16 04:43:54 8.34.210.54 - 10.10.10.31 21 ControlChannelClosed - - 0 0 8bb7b510-d8db-4808-94f0-4177688239fa -<BR />2025-09-16 04:43:55 8.34.210.54 - 10.10.10.31 21 ControlChannelOpened - - 0 0 959e077c-bc84-48c0-bbc1-4ad7af838dc4 -<BR />2025-09-16 04:43:55 8.34.210.54 - 10.10.10.31 21 - - 451 87 0 959e077c-bc84-48c0-bbc1-4ad7af838dc4 -<BR />2025-09-16 04:43:55 8.34.210.54 - 10.10.10.31 21 - - 451 87 0 959e077c-bc84-48c0-bbc1-4ad7af838dc4 -<BR />2025-09-16 04:43:55 8.34.210.54 - 10.10.10.31 21 - - 451 87 0 959e077c-bc84-48c0-bbc1-4ad7af838dc4 -<BR />2025-09-16 04:43:55 8.34.210.54 - 10.10.10.31 21 + - 500 87 0 959e077c-bc84-48c0-bbc1-4ad7af838dc4 -<BR />2025-09-16 04:43:55 8.34.210.54 - 10.10.10.31 21 ControlChannelClosed - - 1292 0 959e077c-bc84-48c0-bbc1-4ad7af838dc4 -</PRE> <P>I can not find any info about this threat when I dig the internet.<BR />Thank you!&nbsp;</P> Wed, 24 Sep 2025 03:05:31 GMT https://live.paloaltonetworks.com/t5/next-generation-firewall/ftp-evasion-detection-id-30401/m-p/1238597#M6314 YanQian 2025-09-24T03:05:31Z