ProFTPD mod_copy exposure triage: proftpd listening on port 21 with mod_copy che
Correlates a running ProFTPD FTP server process listening on TCP port 21 with commands checking or loading the mod_copy module on the same Linux device using Microsoft Defender XDR telemetry.
Microsoft Sentinel (KQL)
