Windows: Detect WinSCP Execution from Non-Default Install Path

title: "Windows: Detect WinSCP Execution from Non-Default Install Path"
id: bad37ba9-1e12-4258-b51b-d696a4c47fff
status: experimental
description: This rule identifies process creation events where WinSCP (WinSCP.exe or OriginalFileName winscp.exe) is executed from a folder other than the expected WinSCP installation directory. Attackers may use portable or relocated WinSCP to blend in while running file transfer capabilities outside of the standard path. The detection relies on Windows process creation telemetry, including the executable path and OriginalFileName.
references:
  - https://blogs.blackberry.com/en/2024/07/akira-ransomware-targets-the-latam-airline-industry
  - https://github.com/SigmaHQ/sigma/blob/master/rules-threat-hunting/windows/process_creation/proc_creation_win_winscp_portable_execution.yml
author: frack113, Huntrule Team
date: 2025-10-12
tags:
  - attack.exfiltration
  - attack.t1048
  - detection.threat-hunting
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    - Image|endswith: \WinSCP.exe
    - OriginalFileName: winscp.exe
  filter_main_location:
    Image|startswith: C:\Program Files (x86)\WinSCP\
  condition: selection and not 1 of filter_main_*
falsepositives:
  - Unknown
level: medium
license: DRL-1.1
related:
  - id: 7674f8ef-7141-4cf0-a311-ee359264c64c
    type: derived