LOL · Binary

scp.exe

2 techniquesWindowsLOLBASGPL-3.0

Execute

ExecutionWindows

Spawns specified command from `scp.exe` -> `ssh.exe`, even if no SSH server is running on localhost (or any other address specified).

Use Proxy execution of specified command, can be used as a defensive evasion.

scp.exe -o ProxyCommand="{CMD}" . localhost:.

Evidence: Upstream reference
Environment: Local host
Context: user
Native: Execute
MITRE: T1202
Detection: IOC: `scp.exe` executions referencing `ProxyCommand`.
Refs: gtfobins.org/gtfobins/scp/
lolbas-project.github.io/lolbas/Binaries/scp/

ExecutionWindows

Spawns specified command from `scp.exe` -> `ssh.exe`, even if no SSH server is running on localhost (or any other address specified).

Use Proxy execution of specified command, can be used as a defensive evasion.

scp.exe -S "{CMD}" . localhost:.

Evidence: Upstream reference
Environment: Local host
Context: user
Native: Execute
MITRE: T1202
Detection: IOC: `scp.exe` executions referencing `ProxyCommand`.
Refs: gtfobins.org/gtfobins/scp/
lolbas-project.github.io/lolbas/Binaries/scp/