mirror of
https://github.com/LOLBAS-Project/LOLBAS
synced 2026-06-21 13:43:46 +00:00
Add SCP.exe for execute operation (#509)
Co-authored-by: Wietze <wietze@users.noreply.github.com>
This commit is contained in:
@@ -0,0 +1,24 @@
|
||||
---
|
||||
Name: scp.exe
|
||||
Description: Used for uploading or downloading files over SSH.
|
||||
Author: BinFault
|
||||
Created: 2026-06-03
|
||||
Commands:
|
||||
- Command: scp.exe -o ProxyCommand="{CMD}" . localhost:.
|
||||
Description: Spawns specified command from `svchost.exe` -> `sihost.exe`, even if no SSH server is running from localhost (or any other address specified).
|
||||
Usecase: Proxy execution of specified command, can be used as a defensive evasion.
|
||||
Category: Execute
|
||||
Privileges: User
|
||||
MitreID: T1202
|
||||
OperatingSystem: Windows 10, Windows 11
|
||||
Tags:
|
||||
- Execute: CMD
|
||||
Full_Path:
|
||||
- Path: C:\Windows\System32\OpenSSH\scp.exe
|
||||
Detection:
|
||||
- IOC: "`scp.exe` executions referencing `ProxyCommand`."
|
||||
Resources:
|
||||
- Link: https://gtfobins.org/gtfobins/scp/
|
||||
Acknowledgement:
|
||||
- Person: BinFault
|
||||
Handle: '@binfault'
|
||||
Reference in New Issue
Block a user