scp.exe

The in-box OpenSSH scp client spawns the program named by -S (alternate ssh program) or ProxyCommand even when no SSH server is listening, giving indirect command execution under a signed binary. scp also legitimately copies files to/from remote hosts and can be used to stage or exfiltrate data.

Use Proxy-execute a command through scp->ssh, or move files off-host, using a signed binary.

scp.exe -S C:\Windows\Temp\x.exe . localhost:.
scp.exe -o ProxyCommand="C:\Windows\Temp\x.exe" . localhost:.

Context

user

Native

Execute

MITRE

T1202T1105

Detection

Detection: scp.exe with -S or -o ProxyCommand; scp.exe child processes (cmd/powershell); scp.exe copying to/from external hosts; scp targeting localhost with no SSH service present.

Verified

✓ LOLBAS Scp.yml quotes both `scp.exe -S "{CMD}" . localhost:.` and `scp.exe -o ProxyCommand="{CMD}" . localhost:.` (spawns even with no SSH), MitreID T1202; match.

Refs

github.com/LOLBAS-Project/LOLBAS/blob/master/yml/OSBinaries/Scp.yml

attack.mitre.org/techniques/T1202/