Windows Unusual FileZilla XML Config Access

This analytic identifies processes accessing FileZilla XML configuration files (recentservers.xml and sitemanager.xml) by monitoring Windows Security Event Code 4663. This activity is considered unusual if not performed by the legitimate FileZilla application or OneDrive, and can indicate unauthorized access or manipulation of sensitive configuration files. Such access could lead to data exfiltration, credential theft, or further system compromise.