PowerShell spawned by MFT service process with discovery or tool download
Detects PowerShell processes spawned by common managed file transfer (MFT) or web service processes (such as Serv-U, GoAnywhere, MOVEit, Cleo, Tomcat, etc.) performing remote system discovery or ingress tool transfer activities.
Splunk (SPL)
