LOL · Binary

Sftp.exe

2 techniquesWindowsLOLBASGPL-3.0

Execute

ExecutionWindows

Spawns ssh.exe which in turn spawns the specified command line. See also this project's entry for ssh.exe.

Use Proxy execution of specified command, can be used as a defensive evasion.

sftp -o ProxyCommand="{CMD}" .

Evidence: Upstream reference
Environment: Local host
Context: user
Native: Execute
MITRE: T1202
Detection: IOC: sftp.exe executions with ProxyCommand on the command line
IOC: sftp.exe spawning ssh.exe with ProxyCommand on the command line
Sigma: github.com/SigmaHQ/sigma/pull/5414/files
Refs: news.sophos.com/en-us/2025/05/09/lumma-stealer-coming-and-going/
lolbas-project.github.io/lolbas/Binaries/Sftp/

ExecutionWindows

Spawns ssh.exe which in turn spawns the specified command line. See also this project's entry for ssh.exe.

Use Proxy execution of specified command, can be used as a defensive evasion.

sftp -D "{CMD}"

Evidence: Upstream reference
Environment: Local host
Context: user
Native: Execute
MITRE: T1202
Detection: IOC: sftp.exe executions with ProxyCommand on the command line
IOC: sftp.exe spawning ssh.exe with ProxyCommand on the command line
Sigma: github.com/SigmaHQ/sigma/pull/5414/files
Refs: news.sophos.com/en-us/2025/05/09/lumma-stealer-coming-and-going/
lolbas-project.github.io/lolbas/Binaries/Sftp/