Add SCP.exe for execute operation (#509)

Co-authored-by: Wietze <wietze@users.noreply.github.com>
This commit is contained in:
x90slide
2026-06-16 01:20:20 +05:30
committed by GitHub
parent 5814631f55
commit 24a46a7e52
+24
View File
@@ -0,0 +1,24 @@
---
Name: scp.exe
Description: Used for uploading or downloading files over SSH.
Author: BinFault
Created: 2026-06-03
Commands:
- Command: scp.exe -o ProxyCommand="{CMD}" . localhost:.
Description: Spawns specified command from `svchost.exe` -> `sihost.exe`, even if no SSH server is running from localhost (or any other address specified).
Usecase: Proxy execution of specified command, can be used as a defensive evasion.
Category: Execute
Privileges: User
MitreID: T1202
OperatingSystem: Windows 10, Windows 11
Tags:
- Execute: CMD
Full_Path:
- Path: C:\Windows\System32\OpenSSH\scp.exe
Detection:
- IOC: "`scp.exe` executions referencing `ProxyCommand`."
Resources:
- Link: https://gtfobins.org/gtfobins/scp/
Acknowledgement:
- Person: BinFault
Handle: '@binfault'