My SIEM has produced something intriguing. I went looking for unauthorized SSH connections, and looked for the SFTP protocol by mistake. I found a Windows web server that is connecting from port 80 to a foreign IP address on port 115.
In researching this I discovered RFC913: Simple File Transfer Protocol (SFTP), a proposed file transfer protocol that was never widely adopted, that was proposed to exist between TFTP and FTP, and ran on port 115. IETF records the port for historical purposes only.
I have run AV and a couple of rootkit tools against the server and have not discovered any infections.
My question is, is anyone aware of any malware, trojans, etc. that leverage simple file transfer?