id: ftp-service-running

info:
  name: FTP Service Running
  author: princechaddha
  severity: high
  description: Checks if the FTP service is running.
  impact: |
    FTP transmits data in plaintext, which can lead to unauthorized access and interception of credentials.
  remediation: |
    Disable the FTP service and use secure alternatives like SFTP.
  tags: windows,ftp,service,insecure,code,windows-audit

self-contained: true

code:
  - pre-condition: |
      IsWindows();
    engine:
      - powershell
      - powershell.exe
    args:
      - -ExecutionPolicy
      - Bypass
    pattern: "*.ps1"
    source: |
      Get-Service -Name ftpsvc | Select-Object -ExpandProperty Status

    matchers:
      - type: word
        words:
          - "Running"
# digest: 490a0046304402204a8d8cc533a8e430cb38130eab7ca3e802e62cc4dcca44aefd6d8cb3098fd4ac02202f372bfc8759a49ac3b8d4dd8f188d1389fcc9898cb92de65ffb8bfc36138e8c:922c64590222798bb761d5b6d8e72950