FileZilla RecentServers.xml Accessed for FTP Credential Theft
Detects access to the FileZilla RecentServers.xml file, which contains historical server connection information. Attackers frequently target this file to extract stored FTP credentials, hostnames, and usernames for lateral movement or data exfiltration.
Sigma
