Windows: Winscp CLI FTP/SFTP Open Attempt via -command

title: "Windows: Winscp CLI FTP/SFTP Open Attempt via -command"
id: 1993472f-e959-43e5-b082-804606bfe9de
status: experimental
description: This rule flags execution of WinSCP where the process command line includes the WinSCP -command flag and an open operation targeting ftp:// (covering FTP and SFTP-style usage). Attackers may use WinSCP as a legitimate client to establish outbound file transfer sessions for exfiltration or staging. The detection relies on Windows process creation telemetry, matching the WinSCP binary and specific command-line parameters.
references:
  - https://blogs.blackberry.com/en/2024/07/akira-ransomware-targets-the-latam-airline-industry
  - https://github.com/SigmaHQ/sigma/blob/master/rules-threat-hunting/windows/process_creation/proc_creation_win_winscp_command_open_ftp.yml
author: frack113, Huntrule Team
date: 2025-10-12
tags:
  - attack.exfiltration
  - attack.t1048
  - detection.threat-hunting
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    - Image|endswith: \WinSCP.exe
    - OriginalFileName: winscp.exe
  selection_cmd:
    CommandLine|contains|windash: -command
    CommandLine|contains|all:
      - "open "
      - ftp://
  condition: all of selection_*
falsepositives:
  - Unknown
level: medium
license: DRL-1.1
related:
  - id: c1477deb-37cf-4439-9ffb-44499acb89d0
    type: derived