Suspicious FTP/SSH Connection by File Transfer Software
Detects successful network connections over FTP (port 21) or SSH (port 22) initiated by common file transfer applications such as WinSCP, FileZilla, psftp, or scp. This activity could indicate data exfiltration, unauthorized access, or command and control.
Microsoft Sentinel (KQL)
