An FTP banner is the greeting message an FTP server sends as soon as a client connects, before any user commands begin. It usually identifies the service, version, or policy text, and in normal use it looks like routine protocol traffic. Because it appears early in the session, defenders sometimes treat it as harmless background noise.
That assumption can be risky. Attackers can hide instructions or trigger data in a banner so that a first-stage tool, script, or implant reads the greeting and acts on it. This makes the banner part of the control plane, not just a status message. In practice, security teams look for unusual banner content, unexpected server responses, and mismatches between the banner and later network behavior. Effective detection combines packet inspection with endpoint telemetry, such as process creation and outbound connections, because a malicious banner may be meaningful only when paired with what the client does next.