LOLBAS. GitHub
LIVING OFF THE LAND / OS BINARIES

Sftp.exe

View source

sftp.exe is a Windows command-line utility that uses the Secure File Transfer Protocol (SFTP) to securely transfer files between a local machine and a remote server.

Execute
02COMMAND EXAMPLES
01ATT&CK TECHNIQUES
01DETECTION RESOURCES
01CAPABILITIES
01 / TRADECRAFT

Command reference

2 examples

Execute2

EXAMPLE 01T1202

Spawns ssh.exe which in turn spawns the specified command line. See also this project's entry for ssh.exe.

COMMAND
sftp -o ProxyCommand="{CMD}" .
USE CASE
Proxy execution of specified command, can be used as a defensive evasion.
PRIVILEGES
User
OPERATING SYSTEM
Windows 10, Windows 11
Execute · CMD
EXAMPLE 02T1202

Spawns ssh.exe which in turn spawns the specified command line. See also this project's entry for ssh.exe.

COMMAND
sftp -D "{CMD}"
USE CASE
Proxy execution of specified command, can be used as a defensive evasion.
PRIVILEGES
User
OPERATING SYSTEM
Windows 10, Windows 11
Execute · CMD
02 / ON DISK

Known paths

C:\Windows\System32\OpenSSH\sftp.exe
03 / DEFENSIVE INTELLIGENCE

Detection & indicators

1 resources

Indicators & detection notes

  • IOC

    sftp.exe executions with ProxyCommand on the command line

  • IOC

    sftp.exe spawning ssh.exe with ProxyCommand on the command line

FURTHER READING

Research & resources

COMMUNITY RESEARCH

Acknowledgements

Swachchhanda Shrawan Poudel@_swachchhanda_
Nir Chako (Pentera)@C_h4ck_0