Windows: WinSCP Execution from Non-Standard Directory
Flags WinSCP started from a non-default directory on Windows to surface potential portable execution.
- Product
- windows
- Category
- process_creation
- Author
- frack113 (SigmaHQ), DRL 1.1
- Published
- 2025-10-12
- Updated
- 2026-07-31
ATT&CK techniques
ExfiltrationRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
Identifies process creation where the executed binary is WinSCP (WinSCP.exe / OriginalFileName winscp.exe) from a directory other than C:\Program Files (x86)\WinSCP\. Attackers may use portable copies or unusual staging locations to blend in while leveraging legitimate tooling. This relies on Windows process creation telemetry, including Image path and OriginalFileName, to compare execution location against the expected installation directory.
Reporting behind it
Changelog
v5- v5Candidate ingested via manual entry.2026-07-31
- v4Candidate ingested via manual entry.2026-07-31
- v3Candidate ingested via manual entry.2026-07-31
- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: "Windows: WinSCP Execution from Non-Standard Directory"
id: bad37ba9-1e12-4258-b51b-d696a4c47fff
status: experimental
description: Identifies process creation where the executed binary is WinSCP (WinSCP.exe / OriginalFileName winscp.exe) from a directory other than C:\Program Files (x86)\WinSCP\. Attackers may use portable copies or unusual staging locations to blend in while leveraging legitimate tooling. This relies on Windows process creation telemetry, including Image path and OriginalFileName, to compare execution location against the expected installation directory.
references:
- https://blogs.blackberry.com/en/2024/07/akira-ransomware-targets-the-latam-airline-industry
- https://github.com/SigmaHQ/sigma/blob/master/rules-threat-hunting/windows/process_creation/proc_creation_win_winscp_portable_execution.yml
author: frack113, Huntrule Team
date: 2025-10-12
tags:
- attack.exfiltration
- attack.t1048
- detection.threat-hunting
logsource:
category: process_creation
product: windows
detection:
selection:
- Image|endswith: \WinSCP.exe
- OriginalFileName: winscp.exe
filter_main_location:
Image|startswith: C:\Program Files (x86)\WinSCP\
condition: selection and not 1 of filter_main_*
falsepositives:
- Unknown
level: medium
license: DRL-1.1
related:
- id: 7674f8ef-7141-4cf0-a311-ee359264c64c
type: derived