{"id":"762bb580-79b4-40f4-8b9e-9349ce1710f4","title":"Indirect Command Execution via SFTP ProxyCommand","description":"Detects the use of SFTP.exe to execute commands indirectly via ProxyCommand parameter.\nThreat actors were seen leveraging this legitimate Windows binary to bypass security controls and execute arbitrary commands while evading detection.\n","author":"Swachchhanda Shrawan Poudel (Nextron Systems)","status":"experimental","level":"medium","date":"2026-04-27","modified":"","tags":["attack.stealth","attack.t1202"],"technique_ids":["T1202"],"logsource":{"category":"process_creation","product":"windows"},"falsepositives":["Legitimate use of SFTP with proxy commands for administration or networking tasks"],"references":["https://lolbas-project.github.io/lolbas/Binaries/Sftp/","https://news.sophos.com/en-us/2025/05/09/lumma-stealer-coming-and-going/"],"source_path":"rules/windows/process_creation/proc_creation_win_sftp_proxy_command_execution.yml","source_sha256":"e58c36edb83343dbd34c3096a266282ec3d48ea191765a3f370406dc34c4475b","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_sftp_proxy_command_execution.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: Indirect Command Execution via SFTP ProxyCommand\nid: 762bb580-79b4-40f4-8b9e-9349ce1710f4\nstatus: experimental\ndescription: |\n    Detects the use of SFTP.exe to execute commands indirectly via ProxyCommand parameter.\n    Threat actors were seen leveraging this legitimate Windows binary to bypass security controls and execute arbitrary commands while evading detection.\nreferences:\n    - https://lolbas-project.github.io/lolbas/Binaries/Sftp/\n    - https://news.sophos.com/en-us/2025/05/09/lumma-stealer-coming-and-going/\nauthor: Swachchhanda Shrawan Poudel (Nextron Systems)\ndate: 2026-04-27\ntags:\n    - attack.stealth\n    - attack.t1202\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    selection:\n        Image|endswith: '\\sftp.exe'\n        CommandLine|contains: 'ProxyCommand='\n    condition: selection\nfalsepositives:\n    - Legitimate use of SFTP with proxy commands for administration or networking tasks\nlevel: medium\nregression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_lolbin_sftp_indirect_cmd_execution/info.yml\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1202","id":"T1202","name":"Indirect Command Execution","page":"techniques/enterprise/T1202/"}],"data_path":"data/detection-rules/762bb580-79b4-40f4-8b9e-9349ce1710f4.json","kind":"sigma"}