From 24a46a7e52acf0aaa89cedbec1abd1dcafe5e383 Mon Sep 17 00:00:00 2001
From: x90slide <45627103+BinFault@users.noreply.github.com>
Date: Tue, 16 Jun 2026 01:20:20 +0530
Subject: [PATCH] Add SCP.exe for execute operation  (#509)

Co-authored-by: Wietze <wietze@users.noreply.github.com>
---
 yml/OSBinaries/Scp.yml | 24 ++++++++++++++++++++++++
 1 file changed, 24 insertions(+)
 create mode 100644 yml/OSBinaries/Scp.yml

diff --git a/yml/OSBinaries/Scp.yml b/yml/OSBinaries/Scp.yml
new file mode 100644
index 0000000..7bfd354
--- /dev/null
+++ b/yml/OSBinaries/Scp.yml
@@ -0,0 +1,24 @@
+---
+Name: scp.exe
+Description: Used for uploading or downloading files over SSH.
+Author: BinFault
+Created: 2026-06-03
+Commands:
+  - Command: scp.exe -o ProxyCommand="{CMD}" . localhost:.
+    Description: Spawns specified command from `svchost.exe` -> `sihost.exe`, even if no SSH server is running from localhost (or any other address specified).
+    Usecase: Proxy execution of specified command, can be used as a defensive evasion.
+    Category: Execute
+    Privileges: User
+    MitreID: T1202
+    OperatingSystem: Windows 10, Windows 11
+    Tags:
+      - Execute: CMD
+Full_Path:
+  - Path: C:\Windows\System32\OpenSSH\scp.exe
+Detection:
+  - IOC: "`scp.exe` executions referencing `ProxyCommand`."
+Resources:
+  - Link: https://gtfobins.org/gtfobins/scp/
+Acknowledgement:
+  - Person: BinFault
+    Handle: '@binfault'