TCP Port 20 – ftp-data

About TCP Port 20

Port 20 carries the IANA assignment for ftp-data. The IANA description reads: ‘FTP’. This port is referenced in 12 IDS rules and exhibits high malware activity in monitored traffic.

IDS Rule References

12 IDS / security rules reference TCP port 20. Presence in IDS rules does not mean traffic on this port is malicious. These are patterns security tools monitor.

Rule categories (top 2): command-and-control (10), trojan-activity (2).

Sample rule descriptions for TCP port 20:

• ET MALWARE Win32/Emotet CnC Activity (POST) M5
• ET MALWARE Win32/Emotet CnC Activity (POST) M6
• ET MALWARE Win32/Emotet CnC Activity (POST) M7
• ET MALWARE Win32/Emotet CnC Activity (POST) M8
• ET MALWARE Win32/Emotet CnC Activity (POST) M10

Malware Activity

Malware activity is frequently observed on this port.

12 of 12 IDS rules for TCP port 20 involve malware activity.

Families observed (top 1): Emotet (12).

Data Sources

This information is compiled from: IANA Service Name and Transport Protocol Port Number Registry, Emerging Threats Open Ruleset (BSD 2-Clause / GPLv2 per SID range), and MITRE ATT&CK (Apache 2.0).