Indirect Command Execution via SFTP ProxyCommand — Sigma Rule

Rule metadata and linked tags

Author: Swachchhanda Shrawan Poudel (Nextron Systems). Source status: experimental; severity: medium. Source dates: 2026-04-27 / not supplied.

{
  "category": "process_creation",
  "product": "windows"
}

Pinned original Sigma rule · Detection Rule License 1.1

Source SHA-256: e58c36edb83343dbd34c3096a266282ec3d48ea191765a3f370406dc34c4475b

Detection logic

Original source YAML. Source-tag agreement is not proof of complete semantic coverage. This rule has not been compiled for a SIEM backend or validated against live telemetry here.

title: Indirect Command Execution via SFTP ProxyCommand
id: 762bb580-79b4-40f4-8b9e-9349ce1710f4
status: experimental
description: |
    Detects the use of SFTP.exe to execute commands indirectly via ProxyCommand parameter.
    Threat actors were seen leveraging this legitimate Windows binary to bypass security controls and execute arbitrary commands while evading detection.
references:
    - https://lolbas-project.github.io/lolbas/Binaries/Sftp/
    - https://news.sophos.com/en-us/2025/05/09/lumma-stealer-coming-and-going/
author: Swachchhanda Shrawan Poudel (Nextron Systems)
date: 2026-04-27
tags:
    - attack.stealth
    - attack.t1202
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        Image|endswith: '\sftp.exe'
        CommandLine|contains: 'ProxyCommand='
    condition: selection
falsepositives:
    - Legitimate use of SFTP with proxy commands for administration or networking tasks
level: medium
regression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_lolbin_sftp_indirect_cmd_execution/info.yml

Original YAML and metadata in JSON

False positives

• Legitimate use of SFTP with proxy commands for administration or networking tasks

Source references

• https://lolbas-project.github.io/lolbas/Binaries/Sftp/
• https://news.sophos.com/en-us/2025/05/09/lumma-stealer-coming-and-going/