Squidbleed Vulnerability - FTP Server on Port 21
Detects outbound network connections from 'squid.exe' to internal IP addresses on port 21 (FTP). This could indicate an attacker controlling an FTP server within the internal network, potentially exploiting a vulnerability like Squidbleed.
Microsoft Sentinel (KQL)

