huntrule

Windows sftp.exe LOLBIN Abuse via -D Flag

Alerts on Windows executions of sftp.exe using the -D flag with a path argument.

FreeUnreviewedSigmamediumv1
title: Windows sftp.exe LOLBIN Abuse via -D Flag
id: 801f1bdd-ef20-48bc-b6cc-0069039fbe31
status: test
description: This rule flags process creation events where the executed binary ends with \sftp.exe and the command line includes the -D option with a path argument. Adversaries can leverage sftp.exe as a living-off-the-land binary to execute or stage actions using a path parameter. Detection relies on Windows process creation telemetry, specifically the image name and command-line content.
references:
  - https://github.com/LOLBAS-Project/LOLBAS/pull/264
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_lolbin_sftp.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2022-11-10
tags:
  - attack.execution
  - attack.stealth
  - attack.t1218
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image|endswith: \sftp.exe
    CommandLine|contains:
      - " -D .."
      - " -D C:\\"
  condition: selection
falsepositives:
  - Unknown
level: medium
license: DRL-1.1
related:
  - id: a85ffc3a-e8fd-4040-93bf-78aff284d801
    type: derived

What it detects

This rule flags process creation events where the executed binary ends with \sftp.exe and the command line includes the -D option with a path argument. Adversaries can leverage sftp.exe as a living-off-the-land binary to execute or stage actions using a path parameter. Detection relies on Windows process creation telemetry, specifically the image name and command-line content.

Known false positives

  • Unknown

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.