LOL · Binary

Sftp.exe

2 techniques WindowsLOLBAS GPL-3.0

Execute

Execution Windows

Spawns ssh.exe which in turn spawns the specified command line. See also this project's entry for ssh.exe.

Use Proxy execution of specified command, can be used as a defensive evasion.

sftp -o ProxyCommand="{CMD}" .

Context: user
Native: Execute
MITRE: T1202
Detection: IOC: sftp.exe executions with ProxyCommand on the command line
IOC: sftp.exe spawning ssh.exe with ProxyCommand on the command line
Sigma: github.com/SigmaHQ/sigma/pull/5414/files
Refs: news.sophos.com/en-us/2025/05/09/lumma-stealer-coming-and-going/
lolbas-project.github.io/lolbas/Binaries/Sftp/

Execution Windows

Spawns ssh.exe which in turn spawns the specified command line. See also this project's entry for ssh.exe.

Use Proxy execution of specified command, can be used as a defensive evasion.

sftp -D "{CMD}"

Context: user
Native: Execute
MITRE: T1202
Detection: IOC: sftp.exe executions with ProxyCommand on the command line
IOC: sftp.exe spawning ssh.exe with ProxyCommand on the command line
Sigma: github.com/SigmaHQ/sigma/pull/5414/files
Refs: news.sophos.com/en-us/2025/05/09/lumma-stealer-coming-and-going/
lolbas-project.github.io/lolbas/Binaries/Sftp/